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SPACE  SHUTTLE  MAIN  ENGINE 
DIGITAL  CONTROLLER 
by 

WALTER  T.  MITCHELL 

Assistant  Chief  Engineer  for  Controller 
and  Electro-Mechanical  Controls  for  the 
Space  Shuttle  Main  Engine 

NASA  MSEC 

Marshall  Space  Flight  Center,  EE21 
Alabama  35812  USA 


SUMMARY 

The  controller,  which  is  an  electronic  package  mounted  on  the  SSME,  operates  in  conjunction  with 
engine  sensors,  valves,  actuators,  and  spark  igniters  to  provide  a  self-contained  system  for  engine 
control,  checkout,  and  monitoring. 

The  controller  provides  responsive  control  of  engine  thrust  and  mixture  ratio  through  the  digital 
computer  in  the  controller,  updating  the  instructions  to  the  engine  contro1  elements  50  times  ir  second 
(every  20  milliseconds).  Additionally,  precise  engine  performance  is  achieved  through  closed-loop  control, 
utilizing  16-bit  computation,  10-bit  input/output  resolution,  and  self  calibrating  analog-to-digital 
conversion.  Engine  reliability  is  enhanced  by  a  dual  redundant  contro]  system  that  allows  normal  operation 
after  the  first  failure  and  a  fail-safe  shutdown  after  a  second  failure. 

The  digital  computer  is  programmable,  allowing  modification  of  engine  control  ations  and  constants 
by  change  of  the  stored  program  (software). 

The  controller  is  packaged  in  a  sealed,  pressurized  chassis  with  cooling  provided  by  convection  heat 
transfer  through  pin  fins  as  part  of  the  main  chassis.  The  electronics  are  distributed  on  functional 
modules  having  special  provisions  for  thermal  and  vibrational  protection. 


PREFACE 

The  Space  Shuttle  Main  Engine  is  a  reusable,  high  performance.  Liquid  Hydrogen/Oxygen,  rocket  engine, 
designed  and  produced  by  the  Rocketdyne  Division  of  Rockwell  International  under  contract  with  the  Marshall 
Space  Flight  Center.  Three  of  these  engines  are  utilized  per  Space  Shuttle  and  are  mounted  in  a 
clustered  configuration  on  the  aft  end  of  the  orbiter.  The  engines  are  started  and  reach  91%  thrust  before 
the  two  Solid  Rocket  Boosters  are  ignited  and  vehicle  lift-off  occurs.  After  approximately  2-1/2  minutes, 
the  Solid  Rocket  Boosters  burn  out,  are  jettisoned,  and  the  SSME  is  the  sole  source  of  thrust  for  an 
additional  six  minutes  until  the  vehicle  almost  achieves  orbital  altitude  and  velocity.  At  this  point, 
the  SSME's  are  shutdown  and  the  large  propellant  tank  (External  Tank)  is  jettisoned  from  the  orbital  vehicle. 
The  three  Sl'ME's  then  dump  the  residual  propellant  left  in  the  orbiter  feed  lines.  Subsequent  to  the 
propellant  dump,  the  SSME's  are  turned  off  and  are  no  longer  used  during  that  orbital  flight  or  re-entry. 

In  order  to  meet  mission  acceleration  requirements,  the  engine  thrust  is  variable  in  17.  increments,  as 
commanded  by  the  orbiter,  from  65 7.  to  109%  of  rated  thrust  470, vDO  pounds  (2,090,660  Newtons).  The 
engine  burn  time  is  a  mission  dependent  variable.  Nominal  burn  L-'me  is  approximately  8.5  minutes,  but 
could  be  extended  to  as  long  as  13.7  minutes  in  the  event  of  certaj  abort  profiles. 

Basically,  the  engine  system  is  composed  of  two  liquid  oxygen  tur,  uaps  (low  pressure  and  high 
pressure),  two  liquid  hydrogen  turoopumps  (low  pressure  and  high  pressure)  main  combustion  chamber, 
nozzle  and  a  control  system  (Figure  1). 

Each  of  the  two  high  pressure  turbopumps  is  powered  by  a  separate  preburner.  Tne  rtaged-combustion  cycle 
burns  low  mixture  ratio  propellants  in  the  preburner  first.  The  resulting  hydiogen  riui  gases  in  turn 
drive  the  high  p-essure  turbopumps  and  are  then  routed  to  the  main  combustion  chamber  where  the  remaining 
oxygen  is  provided  and  the  final  thrust  producing  combustion  is  achieved. 

Thrust  control  is  achieved  by  adjusting  the  power  available  to  the  high  pre.-  Jure  oxidizer  pump. 

This  is  accomplished  by  modulation  of  the  oxidizer  preburner  oxidizer  valve.  Similarly,  mi.-.uire  ratio 
of  6.0  (0/F) is  maintained  by  modulation  of  the  fuel  preburner  oxidizer  valve  which  adjusts  the  powei 
available  to  the  hi0n  pressure  fuel  pump.  In  addition  to  these  two  preburner  valves  three  other 
propellant  valves  (main  fuel,  main  oxidizer,  and  chamber  coolant)  are  position  scheduled  as  a  function 
of  tnrust  level  to  provide  proper  propellant  flow  during  engine  start,  mainstage,  and  shutdown  operations. 


SSME  PROPELLANT  FLOW  SCHEMATIC 
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FIGURE  1 


CONTROL  SYSTEM 

A  fast  response  control  system  is  necessary  in  order  to  accomplish  throttle  control  and  to  maintain 
engine  mixture  ratio  balance  over  the  entire  throttle  range.  Additional  requirements  for  the  control  system 
include  providing  repeatable  start  and  shutdown  operations,  capability  to  monitor  engine  operating  condition, 
and  manage  engine  component  redundancy  during  flight.  This  control  system,  utilizing  special  software 
modules,  also  performs  self  contained  engine  pre-launch  checkout.  The  control  system  is  implemented 
as  a  fully  programmable  digital  system.  This  provides  the  flexibility  and  ease  of  change  needed  during 
engine  R&D  phases  as  well  as  the  autonomy  and  adaptability  required  when  fully  operational.  The 
programmable  digital  computer  and  associated  interface  electronics  is  called  the  controller.  The 
controller  receives  data  for  real  time  processing  from  sensors  (temperature,  pressure,  speed,  flow,  position) 
spark  igniters,  and  five  hydraulically  actuated  and  electronically  managed  propellant  valves.  The 
combination  of  a  digital  computer,  data  generating  devices,  and  responding  propellant  valve  actuators,  and 
solenoids  for  open/close  functions  make  up  the  control  system  for  the  SSME.  The  control  system  has  full 
authority  over  the  operation/performance  management  of  the  engine.  All  logic  necessary  for  the  control 
system  to  meet  its  requirements  is  contained  in  the  flight  operational  software  program.  In  order  to  obtain 
the  necessary  fast  response,  ’  major  cycle  processing  time  of  20  milliseconds  is  established.  Thus,  all 
engine  control,  monitor  and  redundancy  management  functions  are  accomplished  50  times  per  second. 

Since  a  digital  computer  is  used  on  tue  engine,  the  interface  and  interaction  between  the  orbiter 
vehicle  and  the  engine  is  a  command/response  and  data  providing  activity.  For  example,  to  achieve  an 
engine  start,  the  orbiter  need  only  give  the  engine  a  single  command  -  "start".  The  controller  acknow¬ 
ledges  receipt  of  the  command  and  then  accomplishes  the  complex  task  of  Igniting  the  engine  and  controlling 
it  up  to  100%  thrust  within  the  required  3.S  seconds,  all  without  further  involvement  from  the  orbiter. 


There  are  two  distinct  engine  operating  modes  the t  are  regulated  and  monitored  by  the  controller  and 
its  ; oftwaie.  There  is  a  ground  checkout  mode  and  a  flight  operational  mode.  The  software  is  structured 
such  that  basic  executive,  control,  and  monitor  logic  is  resident  at  all  times  and  individual  separately 
loader,  overlay  modules  are  used  for  the  various  engine  tests  performed  during  the  ground  checkout  mode. 

A  single  flight  module  overlay  is  required  for  the  flight  operational  mods. 


GROUND  CHECKOUT  MODE 


Ground  checkout  of  the  engine  is  accomplished  through  6  separate  software  modules.  Each  checkout 
module  is  self-contained  and  is  designed  to  perform  an  automatic  checkout  of  an  engine  functional 
subsystem.  Each  checkout  module,  once  loaded  and  initiated,  automatically  proceeds  either  to  2 
successful  conclusion,  or  i,  unsuccessful,  data  is  provided  to  the  ground  which  isolates  the  fault 
to  a  line  replaceable  unit.  Functional  subsystems  checked  automatically  Include,  the  controller, 
sensors,  propellant  valve  actuators,  pneumatic  solencid  and  check  valve,  spark  ignitor,  and  all 
inter-connecting  electrical  harnesses. 

In  addition  to  the  specialized  checkout  modules  a  Flight  Readiness  Test  module  (FRT)  is  also 
provided.  This  module  allows  simulation  of  the  engine's  flight  mode.  All  operational  flight  commands 
are  accepted  and  the  engine  performance  is  simulated  such  that  a  high  fidelity  orbiter/vehicle  mission 
simulation  can  he  performed. 

OPERATIONAL  MODE 

The  flight  operational  mode  consists  of  5  phases,  start  preparation,  start,  mainstage,  shutdown, 
and  post  shutdown. 

Start  Preparation  Phase  -  The  engine  system  is  conditioned  for  start  during  this  phase.  Upon 
orbiter  command,  the  controller  sequences,  regulates,  monitors  the  fuel  and  oxidizer  system  purges 
which  inert  and  dry  the  engine  prior  to  admitting  propellants.  Propellants  are  then  admitted  to  the 
engine  and  are^recirculated  to  ensure  proper  engine  thermal  conditioning  prior  to  start.  The 
controller  monitors  the  engine  operational  readiness  and  provides  an  "engine  ready"  signal  to  the 

orbiter  when  all  conditions  are  acceptable  for  an  engine  start.  The  "engine  ready"  includes  require¬ 

ments  such  as  fuel  and  oxidizer  temperatures  and  pressures  are  within  acceptable  ranges,  hydraulic 
and  pneumatic  pressure  within  limits,  controller  self-test  satisfactory,  propellant  and  pneumatic 
valves  in  start  position,  etc.. 

Start  Phase  -  The  controller  will  accept  a  start  command  from  the  orbiter  only  if  the  "engine 
ready"  conditions  are  satisfied  at  the  time  of  command  receipt.  The  start  sequence  is  composed  of, 

first,  an  open-loop  and  then  a  closed-loop  control  mode.  During  the  open-loop  mode  the  spark  igniters 

in  each  of  the  three  combustion  chambers  are  energized  and  the  propellant  valves  are  time  sequenced  in 
order  to  achieve  ignition  in  the  proper  sequence  of  the  fuel  and  oxidizer  preburners  and  the  main 
comhustion  chamber.  Closed-loop  control  is  initiated  at  0.6  seconds  in  the  start.  Initial  power 
buildup  of  approximately  20%  rated  thrust  is  accomplished  within  2.35  seconds.  During  this  time 
period,  the  controller  monitors  selected  engine  performance  parameters  to  ensure  proper  ignition, 
acceleration  of  the  high  pressure  turhopumps,  and  thrust  buildup.  Should  these  parameters  not 
achieve  specified  values,  the  controller  will  automatically  shut  the  engine  down.  When  the  final 
ignition  confirmation  of  20%  thrust  level  is  successfully  accomplished  at  2.35  seconds,  the  controller 
regulates  power  buildup  such  that  100%  thrust  level  is  achieved  by  approximately  3.9  seconds. 

Malnstage  Phase  -  The  engine  performance  is  regulated  by  two  inter-related  closed-loop  control 
systems;  one  for  thrust  and  the  other  mixture  ratio  (Figure  2).  Engine  operating  thrust  is  sensed 
by  measuring  the  main  combustion  chamber  pressure.  The  value  is  compared  against  the  orbiter  commanded 
thrust  and  the  resultant  error  signal  is  used  to  determine  a  position  command  for  the  oxidizer  pre¬ 
burner  oxidizer  valve.  These  computations  are  performed  50  times  per  second  (every  20  milliseconds) 
and  the  valve  position  adjusted  as  needed  to  maintain  thrust  performance  within  specified  limits.  The 
controller  will  accept  commands  to  adjust  engine  thrust  from  the  orbiter  in  1%  increments  from  65%  to 
109%  rated  thrust  with  a  maximum  thrust  rate  of  change  of  10%  per  second. 

Engine  mixture  ratio  is  maintained  in  a  similar  manner  at  a  constant  6.0.  The  mixture  ratio  is 
computed  (50  times  per  second)  from  measurements  of  fuel  flow,  propellant  temperature  and  pressure, 
and  main  comhustion  chamber  pressure.  The  computer  mixture  ratio  is  compared  to  the  required  6.0. 

The  error  signal,  compensated  by  current  thrust  level,  is  used  to  position  the  fuel  preburner  oxidizer 
valve.  An  important  aspect  provided  by  the  closed-loop  feedback  control  system  is  that  control 
precision  is  not  affected  by  shifts  in  engine  component  operating  characteristics  such  as  caused  by 
wear  or  thermal  effects.  Control  precision  depends  only  on  sensor  calibration  and  main  combustion 
chamber  calibration.  Each  sensor  is  individually  calibrated  and  the  calibration  data  is  stored  in 
the  controller  software;  therefore,  all  measured  data  is  properly  calibration  compensated  prior  to  use 
in  the  control  equations.  Main  combustion  chamber  calibration  is  obtained  during  engine  acceptance 
test  firings  and  this  data  is  also  used  in  solution  of  the  control  equation.  Once  the  engine  is  calibrated 
the  calibration  is  maintained  by  the  closed-loop  control  system.  Sensor  replacements  can  be  accommodated 
without  requiring  an  engine  lecalibration  firing  by  updating  the  software  with  the  calibration  constants 
for  the  new  sensor. 

Shutdown  Phase  -  Shutdown  may  be  entered  from  any  engine  operating  point  including,  as  previously 
discussed,  start.  In  normal  mission  operation  the  orbiter  will  throttle  the  engine  to  65%  thrust  for 
approximately  10  seconds  and  then  command  shutdown  just  prior  to  orbit  insertion.  The  shutdown  sequence 
is  an  open-loop  mode  and  consists  of  time  dependent  position  schedules  for  the  five  propellant  valves. 

The  valve  schedules  are  modified  as  a  function  of  actual  position  at  time  of  shutdown  initiation  so  that 
thrust  decay  rates  and  engine  operating  temperatures  are  maintained  with  allowable  limits.  During  the 
final  portion  of  shutdown,  selected  purging  is  accomplished.  Purge  initiation  timing  is  dependent  on 
engine  power  level  at  shutdown. 

The  controller  also  has  software  and  hardware  logic  to  select  a  special  pheumatically  driven 
shutdown  sequence  m  the  event  certain  failures  occur  which  prevent  hydraulic  position  control  of  the 
propellant  valves.  This  shutdown  mode  is  achieved  by  the  controller  deactivating  the  hydraulic  actuators 
servovalve  controls  and  a  pneumatic  control  solenoid.  This  establishes  a  pneumatic  circuit  w,  1 ch  performs 
a  sequenced  closing  of  the  propellant  valves. 
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SSME  CONTROL  LOOPS 


FIGURE  2 

Poat-Shutdovm  Phase  -  After  engine  shutdown  the  orbitcr  separates  from  the  "External  Tank". 
Propellant  residuals  trapped  in  the  feed  lines  in  the  orbiter  are  then  separately  exhausted  through  the 
engines.  The  engine's  sequencing  and  pruging  to  perform  this  propellant  dump  is  regulated  and  monitored 
by  the  controller  upon  command  from  the  orbiter, 

ENGINE  LIMIT  MONITORING  AND  REDUNDANCY  MANAGEMENT 

In  order  to  protect  the  orbiter  from  a  catastrophic  engine  malfunction  selected  engine  parameters 
are  monitored  by  the  controller.  Redline  limits  are  set  into  the  software  and  compared  against  actual 
measured  values  50  times  a  second.  Should  the  redline  criteria  for  a  parameter  be  met,  the  controller 
will,  if  enabled  by  the  orbiter,  shut  the  engine  down.  The  redline  criteria  for  a  parameter  includes 
not  only  a  maximum  allowable  value  but  also  the  number  of  consecutive  readings  (20  milliseconds  apart) 
the  parameter  must  exceed  the  maximum  allowable  value.  The  number  of  consecutive  readings  set  in  the 
software  is  normally  three;  thus,  a  parameter  must  "strike"  above  redline  values  three  consecutive  times 
(3strikes)  before  an  engine  shutdown  is  initiated.  This  "strike"  criteria  implemented  into  the  software 
helps  ensure  that  the  condition  observed  is  truly  a  malfunction  and  not  the  result  of  a  temporary  operating 
anomaly  or  momentary  data  error.  As  previously  stated,  exceedance  of  an  engine  redline  will 
result  in  an  engine  shutdown  only  if  enabled  by  the  orbiter.  Since  the  engines  operate  totally  independent 
of  each  other,  the  decision  to  enable  or  inhibit  shutdown  is  vested  in  the  orbiter  as  it  may  be  necessary, 
for  vehicle  and  crew  safety  reasons,  to  continue  operation  of  an  engine  above  redline  limit. 

The  control  system  is  a  dual  redundant  hardware  mechanization  in  order  to  provide  fail  operational/ 
fail  safe  capability.  A  large  part  of  the  flight  operational  software  is  devoted  to  failure  detection 
and  management  of  the  dual  redundant  hardware.  The  details  of  this  redundancy  and  itt>  management  will  be 
discussed  later. 

One  aspect  of  the  redundancy  management  is  to  provide  for  a  degraded  or  "lock-up"  mode  of  engine 
operation  in  the  event  of  concurrent  failure  of  a  performance  control  parameter. 

For  example,  an  electronic  lock-up  mode  is  entered  in  event  of  total  loss  of  the  main  combustion 
chamber  pressure  parameter.  The  thrust  and  mixture  ratio  controls  loops  can  no  longer  be  implemented 
since  they  <'epend  on  the  measured  value  of  the  main  combustion  chamber  pressure.  The  controller  notifies 
the  orbiter  and  enters  a  lock-up  mode  in  which  it  will  no  longer  accept  thrust  change  commands,  deactivates 
the  thrust  and  mixture  ratio  control  loops  and  maintains  the  propellant  values  at  their  last  command 
position.  This  allows  the  engine  to  continue  to  produce  thrust  although  its  performance  may  degrade. 
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The  engine  will  continue  to  operate  in  this  mode  for  the  remainder  of  the  mission  or  until  a  rediine 
condition  is  detected  by  the  controller.  The  other  "lock-up"  mode  (hydraulic  lock-up)  will  be  entered 
when  the  controller  determined  that  both  electronic  servo  control  channels  of  a  hydraulic  actuator  have 
failed.  The  controller  would  deactivate  the  actuator  which  allows  hydraulic  pressure  to  equalize  on  both 
sides  of  the  actuator.  This  causes  the  actuator  to  hydraulically  lock  the  propellant  valve  at  its  current 
position.  The  engine  will  continue  to  operate  in  this  mode  until  the  system  drifts  and  a  rediine  is 
exceeded  or  a  shutdown  is  commanded.  The  shutdown  will  be  accomplished  by  the  previously  discussed 
pneumatic  mode  since  hydraulic  control  can  no  longer  be  effected. 

HARDWARE  MECHANIZATION 

All  critical  electrical  hardware  components  are  redundant  in  order  to  provide  fail  operational/ 
fail  safe  capability.  A  basic  design  requirement  is  that  there  shall  be  no  electrical  single-point  failure 
which  will  result  in  loss  of  controller  function,  engine  shutdown,  or  an  unsafe  operating  condition.  The 
system  is  shown  schematically  in  Figure  5.  The  mechanization  is  such  that  all  elements,  either  sensing  or 
control,  which  are  utilized  in  engine  readiness  determination,  performance  control  or  limit  monitoring 
are  dual  redundant. 

CONTROL  SYSTEM  ORGANIZATION 


FIGURE  3 


The  controller,  which  13  designed  and  manufactured  by  Honeywell,  Incorporated,  is  an  integral 
electronics  package  and  is  mounted  directly  on  the  engine  thrust  chamber.  The  engine  subjects  the 
controller  to  a  very  hostile  vibro-acoustic  and  thermal  environment.  Air  temperature  surrounding  the 
controller  will  vary,  depending  on  engine  operating  phase,  from  +95  degrees  F  to  -55  degrees  F,  while 
atmospheric  pressure  varies  from  ground  ambient  to  the  near  vacuum  of  space.  An  acoustic  impingment 
of  160  db  is  encountered  just  after  vehicle  lift-off.  The  vibration  environment  as  depicted  in  Figure  h 
is  presented  throughout  the  engine  burn  time.  The  controller  is  required  to  operate  within  this  environment 
for  55  missions. 

In  order  to  minimize  vibration  input,  the  controller  is  mounted  to  the  engine  at  four  points  through 
elastomeric  vibration  isolators.  These  isolators  greatly  reduce  the  vibration  input  to  the  controller 
as  can  be  seen  in  the  dashed  curve  of  Figure  4. 


CONTROLLER  VIBRATION  /  RESPONSE 


FREQUENCY  (HZ) 

FIGURE  4 

The  controller  electronics  are  mounted  on  conventional  printed  circuit  cards.  The  printed  circuit 
cards  are  retained  in  the  controller  chassis  by  a  rigid  foam  packaging  system  which  further  isolates  the 
electronics  from  the  vibro-acoustic  environment.  In  this  packaging  system  (Figure  5),  the  chassis  is 
divided  into  cavities  each  of  which  accepts  two  cards.  Each  card  has  an  open  foam  grid  attached  to  the 
component  mounting  side  and  a  foam  half  wedge  attached  to  the  back  side.  The  cards  are  retained  in  the 
chassis  cavity  by  loading  a  foam  wedge  between  the  two  cards.  This  provides  for  very  tight  card  retention 
as  well  as  isolation  from  vibration  transmitted  through  the  chassis  and  detunes  the  printed  circuit 
card/chassis  structure  system.  The  foam  grids,  which  are  in  contact  with  b'  ch  the  printed  circuit  cards 
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and  the  chassis  walls,  have  an  aluminum  foil  surface  which  provides  heat  transfer  from  the  electronics 
parts.  Cooling  is  accomplished  by  convective  heat  transfer  through  the  chassis.  Additional  surface 
area  is  obtained  by  extensive  use  of  pin  fins  machined  into  the  chassis, 
hermetically  sealed  and  pressurized. 


The  controller  chassis  is 


PRINTED  CIRCUIT  BOARD  RETENTION  DESIGN 
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FIGURE  5 


A  functional  block  diagram  of  the  controller  is  shown  in  Figure  6.  The  controller  is  dual  redundant 
with  internal  cross-strapping  to  maximize  the  probability  of  successfully  completing  a  mission  in  the 
event  of  an  internal  failure.  It  consists  of  five  major  subassemblies  each  of  which  are  dual  redundant. 

Digital  Computer  -  The  Digital  Computer  has  a  memory  capacity  of  16,384  words,  is  fully  program¬ 
mable,  and  has  a  memory  cycle  time  of  1  .  The  memory  storage  element  is  2  rail  plated  wire.  Each  word 

is  17-hits  long  including  a  parity  bit.  Even  parity  is  required  for  each  i.emory  read. 

The  central  processor  provides  a  full  set  of  algebraic,  logical  and  input/output  control  instruc¬ 
tions.  The  addressing  scheme  allows  both  direct  and  multi-level  indirect  address  modification. 

Computer  Interface  Electronics  -  The  Computer  Interface  Electronics  (CIEj  interfaces  the  computer 
to  the  input  and  output  electronics,  and  provides  the  command  and  data  interface  with  the  orbiter.  It 
mechanizes  a  Direct  Memory  Access  capability  which  operates  on  a  memory  cycle  steal  basis  and  completely 
refreshes  all  input  data  in  computer  memory  every  20  milliseconds  with  minimum  software  intervention. 
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Input  Electronics  -  All  interface  between  the  controller  and  the  engine  sensors  is  provided  by 
the  input  electronics.  Temperature  and  pressure  measurements  are  accomplished  through  resistor  bridge 
circuits.  There  is  a  separate  bridge  circuit  for  each  temperature  and  pressure  sensor  all  of  which  are 
multiplexed  and  read  by  a  single  10-bit  anaiog-to-digital  converter.  Pump  speed  and  fluid  flow  trans¬ 
ducers  generate  a  pulse  train  of  which  the  frequency  is  velocity  dependent.  The  controller  reads  these 
measurements  by  determining  time  between  consecutive  pulses.  The  input  electronics  provides  the  capability 
to  stimulate  each  sensor  to  determine  its  functional  status  during  ground  checkout.  Analog  parameters 
from  the  output  electronics  and  the  power  supplies  are  routed  to  the  input  electronics  fcr  self  test 
purposes. Data  flow  of  the  critical  engine  sensors  is  such  that  one  element  of  a  redundant  pair  is  routed 
to  the  channel  A  input  electronics  and  the  other  element  is  routed  to  channel  B.  This  arrangement  allows 
continued  access  to  all  engine  critical  parameters  even  in  the  event  of  a  total  failure  of  one  of  the 
input  electronics  channels. 


Output  Electronics  -  The  output  electronics  interfaces  the  controller  with  the  propellant  valye 
actuators,  the  spark  ignitors,  and  the  pneumatic  on/off  solenoids.  A  single  digital  to  analog  converter 
is  multiplexed  to  five  sample  and  hold  circuits,  each  of  which  provides  position  command  to  a  propellant 
valve  actuator  servovalve.  Each  actuator  has  a  primary  and  secondary  servovalve  which  is  selectable  by 
controller  discrete  output.  Discrete  output  drivers  are  provided  to  control  each  pneumatic  solenoid 
and  spark  igniter. 

Power  Supply  -  All  engine  electrical  power  passes  through  and  is  managed  by  the  controller.  The 
orbiter  supplies  the  controller  with  115  VRMS,  3  phase  400  hz,  power  which  the  controller  converts  into 
the  various  dc  voltage  levels  required  for  operation.  The  two  power  suppliers  are  completely  separate, 
one  for  each  controller  channel.  Each  power  supply  is  furnished  power  from  a  separate  source  in  the 
orbiter.  With  this  arrangement,  loss  of  a  single  electrical  power  bus  or  controller  power  supply  does 
not  affect  engine  operation.  Total  loss  of  electrical  power  will  result  in  the  pressure- ladder 
sequenced  pneumatic  engine  shutdown  previously  discussed. 

REDUNDANCY  MANAGEMENT  AND  FAILURE  DETECTION 


The  normal  operating  mode  for  the  controller  (Figure  6)  is  with  the  channel  A  computer  in  control, 
input  data  being  accessed  through  hoth  channel  A  and  B  input  electronics  and  output  control  through 
output  electronics  channex  A.  The  channel  B  computer  is  operating  in  a  ready  stand-by-state  in  order 
to  assure  immediate  control  in  the  eyent  of  a  failure  of  the  channel  A  computer. 


CONTROLLER  FUNCTIONAL  ORGANIZATION 


CHANNEL  B  —  NORMAL  OPERATION 

——  REDUNDANCY  MANAGEMENT  OPTIONS 


FIGURE 
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The  same  software  is  resident  in  both  computers.  The  channel  B  computer,  when  not  in  charge,  is 
able  to  track  the  operation  of  the  channel  A  computer  since  it  also  receives  the  orbiter  commands  and  the 
same  input  data  as  the  channel  A  computer.  There  is  minimum  electrical  interface  between  the  two  computers 
in  order  to  ensure  that  no  single  point  failure  exists  which  could  cause  failure  of  both  computers. 

The  channel  B  computer  is  prevented  from  taking  charge  by  a  "Watch  Dog  Timer"  (WDT).  This  device 
consists  of  a  set  of  electronic  timers  which  must  be  reset  in  the  correct  sequence  each  software  major 
cycle  (20  milliseconds).  Should  the  channel  A  computer  not  properly  perform  this  function,  the  WDT  will 
timeout,  thus  placing  the  channel  B  computer  in  charge.  The  channel  B  computer  also  has  a  set  of  Watch 
Dog  Timers  which  if  not  properly  managed  will  halt  the  computer. 

The  software  can  manage  the  WDT  only  if  the  computer  self  test  is  successfully  executed.  This  self 
test  is  in  the  form  of  a  safflp'e  problem  which  exercises  all  the  computer  instructions  and  parity  detection 
capability.  The  self  test  is  extrated  every  major  cycle  (20  milliseconds). 

The  controller  has  "built-in  test  equipment"  (BITE)  points  that  are  sampled  by  the  software  such  that 
the  full  operational  status  of  the  controller  is  verified  every  20  milliseconds.  Should  a  fault  be  detected, 
the  software  ceases  using  the  failed  element  and  activates  the  redundant  element. 

For  example,  should  the  address  decoder  in  the  channel  A  output  electronics  fail  an  echo  check  the 
software  effects  an  immediate  retry.  Should  this  also  fail,  the  channel  A  output  electronics  would  be 
declared  failed,  control  would  be  switched  to  output  electronics  channel  B,  and  engine  operation  would 
continue,  unaffected  by  the  controller  electronics  failure.  The  failure  of  the  output  electronics 
would  be  reported  to  the  orbiter  so  that  it  would  be  known  that  repair  of  the  controller  will  be  required 
when  the  mission  is  completed. 

The  controller  also  provides  for  failure  detection  of  the  elements  of  the  control  system  external 
to  the  controller.  Where  possible,  the  controller  interfacing  electronics  is  designed  such  that  the  most 
probable  failure  mode  of  a  device  (usually  an  open  or  a  short  circuit)  causes  an  unreasonable  value  to  be 
read  for  this  device.  The  software  logic  detects  this  out  of  specification  "strike"  and  does  not  utilize 
the  input  from  that  device  for  the  current  computation  cycle.  Should  this  device  strike  3  consecutive 
times  it  will  be  declared  failed  and  permanently  disqualified.  In  normal  operation  the  outputs  of  a  dual 
redundant  pair  are  averaged  to  provide  the  parameter  data.  In  the  event  of  a  failure  of  one  element, 
the  parameter  data  is  still  available  from  the  other  element  and  engine  operation  continues  unaffected. 

As  previously  discussed,  degraded  engine  operating  modes  are  provided  by  the  controller/software  in  the 
event  of  total  failure  of  a  critical  performance  parameter. 

CONTROL  SYSTEM  INTEGRATION 

The  SSME  control  system  just  described  is  a  complex  hardware/software  system.  Extensive  analysis 
and  testing  has  been  necessary  in  order  to  develop  and  verifv  the  control  system  hardware/software 
implementation.  The  majority  of  the  control  system  testing  has  been  accomplished  in  a  simulation 
laboratory.  This  laboratory  employs  actual  flight  configuration  control  system  hardware  (controller, 
sensors,  actuators,  and  etc.)  interfaced  to  a  hybrid  analog/digital  real  time  engine  system  simulator. 

The  simulation  laboratory  provides  the  capability  to  verify  proper  control  system  response  and  redundancy 
management  actions  when  presented  with  off-nominal  engine  performance  and  hardware  failures. 

This  simulation  laboratory  provides  a  high  fidelity  test  bed  which  allowed  detailed  integration 
testing  of  the  control  system  orlor  to  use  in  actual  SSME  engine  test  firings-  Since  the  initiation  of 
engine  test  firings,  the  Simulation  Laboratory  continues  to  be  extensively  used  for  software  verification. 
All  software,  including  changes,  is  verified  in  the  Simulation  Laboratory  prior  to  release  for  engine  use. 

FIELD  EXPERIENCE 

The  SSME  Digital  Control  System  has  been  utilized  for  all  engine  test  firings.  As  of  this  writing, 

15  different  SSME's  have  accumulated  a  total  of  500  test  firings  and  over  50,000  test  seconds. 

As  the  SSME  system  has  matured  through  this  test  program,  several  control  system  requirement  additions 
and  changes  have  been  made.  The  flexability  provided  by  use  of  a  fully  programmable  digital  computer 
has  allowed  the  majority  of  these  changes  to  be  accomplished  by  software  modification.  This  has  allowed 
rapid  change  incorporation  and  verification  (through  use  of  the  Simulation  Laboratory)  with  only  minor 
perturbation  to  engine  test  schedules. 

The  large  amount  of  "in  use"  experience  has  demonstrated  that  the  basic  concept  of  a  digital  control 
system  for  the  SSME  as  well  as  the  hardware/software  Implementation  of  that  system  is  sound  and  capable 
of  fulfilling  the  operational  requirements  which  have  been  oreviously  discussed. 

CONCLUSION 

The  performance  requirements  of  the  Space  Shuttle  Main  Engine  coupled  with  the  requirement  for 
fall  operational/fail  safe  capability  during  all  phases  of  engine  operation  dictated  a  control  system 
design  that  is  unique  to  large  rocket  engines.  The  control  system  is  implemented  as  a  fully  programmable 
digital  system  which  has  full  control  authority  during  all  engine  operational  modes.  The  controller 
performs  automatic  checkout  of  itself  and  the  engine,  and  controls  engine  start,  nainstage  and  shutdown. 

The  controller  monitors  critical  parameters  to  determine  operating  condition.  If  an  anomaly  is  detected, 
the  controller  attempts  to  keep  the  engine  operational  by  switching  to  a  redundant  system  or  by  providing 
degraded  operating  modes,  rn  the  event  continued  engine  operation  cannot  be  maintained  within  redline 
limits,  the  controller  shuts  the  engine  down  if  enabled  by  the  orbiter. 
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DISCUSSION 


R.L.De  Hoff.  US 

( 1 )  Are  tire  two  digital  processors  running  asynchronously? 

(2)  If  so,  have  you  observed  switching  transients  during  processor  failures  at  critical  operating  conditions,  e.g.  rapid 
thrust  maneuvers,  start  up,  shut  down,  etc.9 

Authors  Reply 

(I )  The  two  computers  aie  not  in  sync  -  The  channel  B  computer  is  able  to  track  the  channel  A  computer  within 
the  same  major  cycle  since  both  computers  receive  the  same  input  uata  and  01  biter  commands. 

(?>  There  are  switching  transients  they  are  minor,  however,  during  steady  state  or  thrust  changes  (thrust  change 
is  slow-limited  to  10%/sec  maximum)  Computer  switch  over  and  regaining  full  and  stable  control  takes 
approximately  80  ms. 

There  are  times  during  the  engine  start  sequence  in  which  a  switch  of  computers  or  output  electronics  cannot 
be  allowed  since  the  transient  will  likely  cause  turbine  damage  The  failure  response  during  this  time  period  is 
engine  shut  down  rather  than  redundancy  switching. 

R. Smyth,  Ge 

What  type  of  information  is  given  to  the  crew  in  space  shuttle  to  monitor  engine  performance  and  operation? 

Author's  Reply 

The  crew  is  provided  with  the  engines  thrust  in  %,  i.e.  90%,  100%  etc.  and  operating  status  either 
normal  mainstage 
-  electronic  lockup 
hydraulic  lockup 
shut-down 

The  crew  is  provided  with  the  capability  to  command  the  engines  to  inhibit  its  limit  exceeded  shutdown.  Launch 

mission  rules  allow  the  inhibiting  of  engine  limit  shut  down  under  certain  emergency  conditions. 


R.Lo,  Ge 

Using  chamber  pressure  for  calculating  oxygen  flow  rate  requires  detailed  combusion  efficiency  information 
(e  g.  i?(-*  =  /  (total  thrust).  Is  the  latter  constant  enough  to  rely  on  it?  For  instance,  would  not  the  system  inter¬ 
pret  an  injection  head  failure  as  a  change  in  oxygen  flow? 

Author’s  Reply 

The  C*  efficiency  of  the  engine  is  known  within  certain  bounds  by  design. 

Actual  C*  as  a  function  of  power  level  is  determined  by  engine  calibration  firings.  This  curve  as  a  function  of  power 
level  is  used  by  the  software  to  calculate  liquid  oxygen  flow.  Should  a  malfunction  occur  in  the  engine  system 
which  affects  C*  this  can  be  noted  by  a  change  in  the  engine  operating  balance.  Limits  are  placed  on  the  control 
system  authority  to  prevent  an  occurence  of  this  type  from  d  i/ing  the  engine  into  an  over  temperature  shut-down. 


J.F. Evans,  UK 

Could  the  author  please  explain  how  they  achieved  adequate  confidence  that  the  watch  dog  timer  would  detect  a 
faulty  computer.  What  actual  probability  of  undetected  computer  failure  remains? 

Author’s  Reply  (Post  meeting) 

The  “WDT”  is  actually  a  “dumb”  timer  which  if  not  properiy  managed  will  time  out  in  20  ms  and  halt  its  associated 
computer  To  keep  the  WDT  from  timing  out  the  software  must  sequentially  access  the  timer  only  during  several 
key  “gate”  times  within  the  20  ms  major  cycle  The  software  manages  the  WDT  in  correct  sequence  as  a  result  of 
successfully  passing  an  increment  of  the  computer  self-test  program  The  instruction  set  for  management  of  the 
WDT  is  not  contained  in  one  series  of  locations  but  rather  is  scattered  throughout  memory.  This  makes  the 
probability  of  a  computer  gone  “wild”  yet  keeping  itself  alive  by  properly  managing  its  WDT,  Kill. 

The  computer  self-test  program  provides  0reater  than  95%  coverage. 


H  Austin  Spang  III,  US 

( 1 )  What  type  of  memory  is  used?  Is  it  read  only? 

(2)  Does  each  computer  check  the  other  or  is  it  only  based  on  watch  dog  timer9 


1-11 

Author’s  Reply 

(1)  The  memory  is  read/write  NDRO  mechanized  in  form  of  2  mil  plated  wire  as  the  storage  element. 

(2)  The  channel  A  and  channel  B  computers  do  not  test  each  other.  Each  computer  performs  a  comprehensive 
self-test  each  major  cycle.  The  successful  completion  of  this  self-test  allows  that  computer  to  manage  its 
watch  dog  timer.-  Please  see  page  9  of  my  paper,,  the  first  few  paragraphs,  for  a  more  detailed  discussion. 

T.O’Brien,  UK 

How  are  common  mode  failures  avoided  in  the  software?  Is  the  redundancy  provided  similar  or  dissimilar? 
Author’s  Reply 

Both  computers  contain  the  same  software. 

Very  extensive  Failure  Mode  Effects  Analyses  are  conducted  by  Hardware/Software  systems  personnel  (not  the 
software  designers)  to  detect  the  presence  of  any  single  point  failures.  In  addition  extensive  software  testing  is 
performed  which  includes  failure  injection  to  verify  that  no  single  point  failures  exist. 


B.J.Cocking,  UK 

Could  you  please  give  details  of  your  sensor  validation  techniques? 

Author’s  Reply 

Reasonable  limits  for  the  fuel  flow  measurement  are  calculated  as  a  function  of  currently  measured  thrust.  By 
measunng  Main  Combustion  Chamber  Pressure  and  knowing  that  the  engine  mixture  ratio  is  6.0  one  can  then 
calculate  the  approximate  value  that  fuel  flow  must  be.  An  additional  tolerance  is  added  to  this  calculated  value 
and  it  then  becomes  the  upper  and  lower  reasonable  limit  for  the  fuel  flow  meter  for  that  major  cycle. 


M.J.Joby,  UK 

(1 )  Please  describe  the  circuit  board  interconnect  system  employed. 

(2)  In  the  event  of  a  detected  system  failure,  are  any  means  of  locating  and  recording  these  faults  provided? 

Author’s  Reply 

(1 )  The  interconnection  between  the  printed  circuit  cards  is  mechanised  by  a  discrete  wire  system  similar  to  wire 
wrap.  The  system  used  is  ‘  stitch  welding”.  The  discrete  wires  are  #  30  size  nickel  and  are  “spot”  welded  to  a 
stainless  steel  terminal  by  an  electrical  discharge. 

(2)  Yes  every  possible  failure  has  a  failure  code  assigned.  When  a  failure  is  detected  its  failure  l.D.  and  parameter 
value  is  telemetered  as  well  as  stored  in  computer  memory. 


EXPERIMENTAL  FULL -AUTHORITY  DIGITAL  ENGINE  CONTROL  ON  CONCORDE 
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Members  of  the  Research  &  Advanced  Sperry  Gyroscope 

Development  Dept.  C.S.E  &  A.  (formerly  of  Rolls-Royce  Ltd.) 
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SUMMARY 

The  paper  describes  what  is  believed  to  be  the  first-ever  flight  standard  full- 
authority  digital  engine  controller.  Initial  design  commenced  in  1971  and  flight 
trials  were  conducted  in  1976. 

As  well  as  the  existing  dry  engine  control  and  monitoring  functions,  the 
controller  incorporated  reheat  control,  fault  recording  and  ground-check,  and  fitted 
into  the  same  volume  as  the  existing  analogue  dry  engine  controller.  Particular 
emphasis  is  given  to  computer  monitoring  techniques  and  the  production  of  high- 
integrity  software. 

1.0  INTRODUCTION 

Work  on  full-authority  digital  control  for  gas  turbines  was  started  at  Rolls- 
Royce  Limited  Aero  Division,  Bristol  (then  Bristol  Siddeley  Engines  Ltd.)  in  1963  and 
resulted  in  the  first  demonstration  of  this  type  of  control  ir.  the  U.K.  in  1965. 

The  demonstration  was  of  control  of  a  single-spool  engine,  and  subsequent  work 
resulted  in  demonstrations  of  control  of  more  complex  engines  and  also  features  such 
as  self-test  and  on-line  fault  detection. 

By  1970  the  capabilities  of  digital  computers  for  full-authority  gas  turbine 
control  were  widely  appreciated,  but  it  was  doubted  that  digital  controllers  could 
compete  with  analogue  controllers  in  actual  flight  applications.  By  this  time,  however, 
the  technology  had  advanced  sufficiently  for  a  flight  demonstration  to  be  contemplated, 
and  in  1971  a  collaborative  exercise  involving  Lucas  Aerospace  Ltd. ,  the  British 
Ministry  of  Defence  (Procurement  Executive),  and  Rolls-Royce  Ltd.  Aero  Division  was 
launched. 

The  Concorde  aircraft  was  selected  as  the  most  likely  demonstration  vehicle  as  its 
Olympus  593  engines  already  had  analogue  electronic  controllers.  Hence  it  was  convenient 
to  configure  the  digital  controller  as  a  direct  plug-in  replacement  for  the  existing 
controller,  providing  both  a  flight  demonstration  and  a  direct  comparison  with  an 
analogue  controller. 

Lucas  Aerospace  Ltd.  were  to  provide  the  hardware  and  Rolls-Royce  Ltd.  Aero 
Division,  the  software. 

In  the  event  the  first  flight  took  place  in  July  1976  on  board  Concorde  202. 

2 . 0  CONCORDE  POWERPLANT  CONTROL  SYSTEM 


The  dry  engine  control  system  comprises  two  control  lanes.  In  this  configuration 
one  lane  controls  the  engine,  the  other  lane  being  switched  off.  If  a  fault  occurs  in 
the  working  lane  it  is  automatically  detected  by  the  lane's  own  self -monitoring 
arrangements.  If  the  fault  persists  the  lane  automatically  depowers  and  the  second  lane 
automatically  resumes  control. 

Each  lane  has  its  own  actuators,  the  mechanical  drives  being  consolidated  via 
differential  gearboxes  to  control  the  engine  fuel-flow  and  primary  nozzle  area. 

The  reheat  control  is  simplex,  driving  one  actuator  to  control  the  fuel-flow. 

3.0  OBJECTIVES 

The  broad  objectives  were  to  :- 

a)  Frovide  dry  engine  control  identical  to  that  provided  by  the  analogue  controller. 

b)  Detect  transducer  faults  at  least  as  well  as  the  analogue  controller. 

c)  Detect  a  very  high  proportion  of  internal  faults. 

d)  Record  all  detected  faults,  whether  transient  or  permanent. 

e)  Incorporate  ground  check  with  very  little  additional  hardware. 

f)  Provide  reheat  control  (normally  a  separate  unit  on  Concorde). 

g)  Fit  into  the  same  volume  (ARINC  ^  ATR  Long)  as  the  analogue  dry  engine 

controller  alone. 

The  objectives  were  all  met,  although  the  reheat  control  was  not  test-flown 
because  of  equipment  configuration  limitations. 

The  completed  controller  had  sufficient  unused  capacity  to  have  incorporated  some 
other  function  such  as  engine  life  recording,  which  requires  only  about  400  words  of 
computer  store  and  lmSec.  run-time  to  calculate  low  cycle  fatigue  and  creep  damage. 


4.0  INTEGRITY  REQUIREMENTS 

The  Civil  Aviation  Authority  has  laid  down  the  Concorde  integrity  requirements 
(TSS  1).  These  requirements,  taken  in  conjunction  with  the  relevant  British  Civil 
Airworthiness  Requirement  (BCAR  Paper  No. 484),  lead  to  the  following  conclusions  :- 

a)  The  in-flight  shut-down  rate  due  to  electronics  failure  should  not  exceed  2.3  x 
10_6  per  engine-hour. 

b)  The  upwards  runaway  rate  due  to  electronics  failure  must  not  exceed  10~6  per  engine- 
hour.  (This  figure  takes  account  of  the  independent  overspeed  limiter). 

c)  The  downwards  runaway  rate  due  to  electronics  failure  should  not  exceed  2.7  x 
10-6  per  engine-hour.. 

The  above  conclusions  assume  independent  failures  in  the  electronics. 

This  assumption  does  not  apply  to  the  software  which,  in  a  fully  digital 
installation,  could  be  common  to  all  lanes,  both  controlling  and  standby.  In  that  case, 
and  as  software  errors  have  undefinable  effects,  such  errors  must  not  cause  a  failure 
rate  greater  than  10-8  per  engine-hour.  Unlike  hardware,  software  does  not  have  a  true 
failure  rate  -  it  is  either  always  faulty  or  always  good,  although  a  fault  may  remain 
dormant  for  a  long  time.  However,  it  is  extremely  unlikely  that  such  a  fault  would 
remain  dormant  for  108  hours,  and  thus  the  final  conclusion  is  :- 

d)  In  this  type  of  system  there  must  be  no  software  errors  -  the  computer  programs 
must  conform  to  the  specifications  for  all  combinations  of  inputs. 

5.0  HARDWARE 

5.1  Overall  System 

The  system  (shown  in  Fig.l)  was,  apart  from  the  computer  monitor,  a  simple 
arrangement  using  standard  circuitry  for  signal  conditioning,  multiplexing,  analogue/ 
digital  conversion  etc.  connected  to  the  computer  via  a  bi-directional  highway.  Most 
of  the  circuitry  is  not,  therefore,  described  in  detail. 

5.2  Inputs /Outputs 

The  control  required  20  variable  inputs,  18  discrete  inputs,  3  actuator  drives, 
one  variable  d.c.  output  and  14  discrete  outputs. 

The  variable  inputs  were  a  mixture  of  thermocouple,  resistance  bulbs,  2.3  KHz  and 
400  Hz  amplitude-modulated  signals,  very  low  frequencies  (down  to  8  Hz )  and  two  higher 
frequencies  (up  to  6  KHz)  which  were  both  converted  directly  to  digital  form. 

The  actuator  drives  were  simple  pulse  drives  counting  out  the  number  of  cycles  ot 
400  Hz  demanded  by  the  computer  to  2-phase  induction  motors. 

In  addition  to  the  control  requirements  there  was  a  400  Hz  amplitude  monitor  (used 
by  the  computer  to  compensate  400  Hz  transducer  readings),  a  400  Hz  current  monitor,  two 
D.C.  levels  to  monitor  the  performance  of  the  analogue/digital  converter,  a  D.C.  signal 
to  the  Reheat  Controller  and  the  controls  for  the  Ground  Check  and  Fault  Recorder. 

5.3  Computer 

After  a  comprehensive  computer  survey  the  Sanders  Associates  Inc.  MIP-16  was 
selected  as  the  most  suitable  for  this  application.  This  computer  had  a  multiple- 
register  architecture  and  8192  x  16-bit  words  of  core  store.  With  core  store  the 
register-register  add  time  was  a  nominal  1  p Sec.  and  the  multiply  time,  4.4  pSec. 

(It  is  some  indication  of  software  complexity  that  the  total  program  run-time  required 
more  than  40mSec.  of  the  5GmSec.  sample  period). 

5 . 4  Computer  Monitoring 

Safety  circuits  were  provided  for  the  computer  only,  the  philosophy  being  that  a  well- 
monitored  computer  is  capable  of  monitoring  the  remainder  of  the  system.  These  circuits  are 
worthy  of  more  detailed  consideration,  as  the  integrity  of  the  controller  depended  entirely 
upon  them.  Basically  there  were  three  primary  safety  circuits;  a  Watchdog  Timer,  a  Store 
Adder  and  a  Comparator,  but  for  completeness  the  Sample-Rate  Clock  is  included  in  the 
description.  A  secondary  circuit  known  as  a  Fault  Integrator  was  also  incorporated. 

a )  Sample  Rate  Clock  ( S. R . C. ) 

This  was  a  crystal-controlled  clock  which  interrupted  the  computer  at  50mSec. 
intervals.  In  response  to  an  interrupt  the  computer  addressed  the  Watchdog  Timer 
before  running  the  next  cycle  of  control. 

b)  Watchdog  Timer  (W.D.T.) 

This  was  also  a  crystal-controlled  clock,  independent  of  the  Sample-Rate  Clock,  but 
instead  of  interrupting  the  computer  it  opened  a  time  'window'  of  0.25mSec,  about  0.125mSec. 
before  the  S.R.C.  interrupt  was  due.  If  the  computer  did  not  address  the  W.D.T.  within 
this  0.25mSec.  window  period,  a  fault  was  declared.  In  addition,  a  fault  was  declared  if 
the  computer  addressed  the  W.D.T.  outside  the  window,  or  more  than  once  within  it. 

The  action  of  the  computer  in  addressing  the  W.D.T.  started  a  delay  of  49.875mSec.  at 
the  end  of  which  time  the  next  window  was  opened,  and  so  the  system  was  self-synchronising 
in  that  frequency-drift  did  not  trip  the  safety. 

This  sequence  is  shown  in  Fig.  2. 

The  W.D.T,  crystal  oscillator  also  supplied  the  computer's  clock  (5  MHz),  so  the 
combined  effect  of  the  S.R.C.  and  W.D.T.  was  to  check  that  the  computer  was  supplied 
with  the  correct  frequency,  was  not  stopped  and  was  not  'running  wild". 

c )  Store  Adder 

To  preserve  the  integrity  of  the  system  it  was  necessary  to  check  the  store  every 
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sample  period,  as  the  actuators  could  move  a  significant  distance  in  two  sample  periods. 
Since  the  'off  the  shelf'  computer  had  no  parity  check,  and  as  there  was  insufficient 
time  in  sample  period  for  the  computer  to  perform  a  normal  store  sum-check,  a  separate 
arithmetic  unit  and  accumulator  were  connected  to  the  highway  between  the  store  and 
control  processor  unit.  The  function  of  the  arithmetic  unit  was  to  sum  the  machine-code 
instructions  and  constants  as  they  were  read  from  the  program  store  area.  In  the  soft¬ 
ware,  every  possible  path  through  the  total  program  was  'padded'  with  dummy  instructions 
such  that,  regardless  of  which  path  was  followed  through  the  program,  a  known  fixed  total 
should  appear  in  the  accumulator  at  the  end  of  each  sample  period.  Hence  any  store  fault 
was  detectable  before  it  could  have  a  significant  effect. 

In  order  to  minimise  the  additional  hardware  a  16-bit  adder  with  an  'end-around  carry' 
technique  was  used,  whereby  if  an  addition  produced  a  carry,  the  carry  digit  was  added 
into  the  lea_st-sianif  leant  end  of  the  accumulator. 

d)  Comparator 

The  comparator  was  required  to  check  the  number  in  the  accumulator  of  the  store  adder 
at  the  end  of  each  sample  period.  In  order  to  ensure  that  a  comparison  actually  occurred, 
the  comparator  was  strobed  by  the  W.D.T.  address  signal  from  the  computer.  (Lack  of  this 
address  would  have  tripped  the  W.D.T.  If  the  number  was  incorrect  a  fault  declaration 
was  made.  This  comparator  was  also  used  for  comparison  of  partial  results  in  successive 
sample  periods,  as  described  in  the  Software  section. 

e)  Fault  Integrator 

If  a  fault  was  detected  in  the  existing  analogue  controller  the  actuator  were 
immediately  locked,  or  'frozen1,  into  position.  If  the  fault  persisted  for  about  l|  sec. 
the  controller  was  depowered  and  a  standby  controller  switched  on.  If  the  fault 
persisted  for  less  than  that  time  the  controller  resumed  control,  but  if  then  the  fault 
occurred  a  full  new  I5  sec.  period  was  started. 

In  the  digital  controller  this  area  was  designed  differently,  using  an  up/down  counter 
which  counted  up  to  a  'trip'  level  (when  a  fault  occurred)  four  times  faster  than  it 
counted  down  to  zero  (when  no  fault  was  present).  The  effect  of  this  was  to  retain  the 
analogue  system's  1,5  sec.  delay  for  a  permanent  fault,  but  if  an  intermittent  fault 
occurred  sufficiently  often  to  significantly  degrade  the  control,  the  controller  would 
depower  after  some  longer  period.  For  example,  if  a  fault  occurred  every  other  sample 
period,  the  controller  would  not  depower  until  after  about  4  sec.  As  the  actuators  were 
frozen  only  during  faulty  sample  periods  some  measure  of  control  was  retained. 

With  a  fault  every  5th  sample  period,  no  depower  occurred  but  control  was  not 
noticably  degraded.  Hence  the  system  would  depower  if  a  series  of  intermittent  faults, 
sufficient  to  degrade  control,  occurred. 

The  operation  is  shown  in  Fig. 3,  with  sample  periods  exaggerated  for  clarity. 

The  complete  computer  monitoring  system  is  shown  in  Fig. 4, 

5. 5  Ground  Check 

Any  safety  circuit  has  dormant  failure  modes,  where  the  circuit  fails  with  no 
immediate  effect  but  is  incapable  of  detecting  faults.  Hence  such  circuits  should  be 
periodically  checked  at  intervals  determined  by  the  dormant  failure  rate. 

No  additional  hardware  was  required  to  check  the  safety  circuits  -  the  computer  was 
made  to  simulate  the  various  types  of  fault  and  for  each  one,  checked  that  the  actuators 
were 'frozen ' ,  as  described  in  section  6.13. 

It  was  decided  to  incorporate  as  many  checks  as  possible  on  those  transducers  which 
could  fail  undetectably  with  the  engine  stopped  ,  for  example  spool-speed  probes.  In  the 
case  of  these  probes  it  was  decided  to  inject  a  frequency  to  check  for  probe  continuity. 
Also,  an  extra  datum  was  incorporated  in  the  jet-pipe  temperature  measuring  system  to 
enable  it  to  measure  over  a  lower-than-normal  range,  the  intention  being  to  permit  a 
comparison  with  the  intake  temperature  reading  on  a  cold  engine.  As  none  of  the  other  tests 
required  hardware,  it  can  be  seen  that  very  little  additional  hardware  was  required.  These 
ground  checks  were  known  collectively  as  the  'A'  checks,  and  totalled  35  checks,  described 
in  section  6.13. 

Further  checks,  of  the  fault  integrator,  final  lane  depower  and  lane-change,  were 
necessary.  Since  these  actions  initiated  audible  and  visual  warnings  on  the  flight-deck, 
it  was  decided  that  they  should  not  be  included  in  the  pre-flight  check,  but  should  be 
performed  much  less  often.  Thus  they  were  classified  separately  as  the  ' B '  checks. 

The  checks  were  controlled  from  the  front  of  the  unit.  A  three-position  switch,  a 
push-button,  a  green  'GO'  placard,  a  red  'FAIL'  placard  and  eight  light-emitting  diodes 
(LEDs)  were  provided  as  shown  in  Fig. 5. 

Experience  has  shown  that  if  no  visible  effects  occur  while  a  ground  check  is  being 
run,  there  is  some  scepticism  about  whether  the  tests  have  actually  been  performed.  In 
addition,  the  operation  of  a  push-button  should  have  some  immediate  visual  effect.  Hence 
for  both  psychological  and  practical  reasons  the  'GO'  placard  was  made  to  flash  at  about 
1/4  sec.  intervals  and  a  rapidly  changing  count  was  displayed  on  the  LED s  during  the  'A' 
checks. The  method  of  initiating  the  'A'  checks  was  merely  to  place  the  three-position 
switch  m  the  'A'  position,  depress  the  'Ground-Check'  push-button  and  wait  until  either 
the  'GO'  placard  stopped  flashing  and  lit  steadily  (after  about  5  sec,),  or  the  'FAIL' 
placard  lit.  In  the  case  of  a  fault,  a  code  was  displayed  on  the  LEDs  to  denote  the 
fault  site,  and  the  software  latched  up  to  prevent  further  operation.  In  the  '•o-fault 
case  a  further  press  of  the  push-button  returned  the  controller  to  normal  operai'on. 

Cor  the  'B'  checks  the  'GO'  placard  went  out  and  the  'FAIL'  placard  lit. 

It  should  be  noted  that  software  interlocks  were  provided  to  prevent  operation  ot 
these  checks  with  the  engine  running. 

5 . 6  Fault  Recorder 

A  clear  distinction  must  be  drawn  between  the  Grpund-Check  and  On-Line  Monitoring. 

The  Ground-Check  was  checking  only  for  dormant  faults  m  the  safety  circuits,  and 
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transducer  faults  which  were  dormant  with  the  engine  stopped.  The  On-Line  Monitoring 
computer  program  described  in  section  6.8,  on  the  other  hand,  was  aimed  at  detecting 
faults  which  could  have  had  immediate  and  potentially  catastrophic  effects  on  the  engine. 

All  such  computer-detected  faults,  whether  transient  or  permanent,  were  stored  as  a  code 
in  a  table  in  the  core  store.  In  addition  a  count  of  the  number  of  times  the  fault 
occurred  was  stored  with  the  code,  so  that  intermittent  faults  could  be  identified. 

The  Ground  Check  controls,  with  the  switch  in  the  PFR  (Post  Flight  Readout) 
position,  were  used  to  display  the  codes  and  counts  on  the  8  LEDs.  It  was,  however, 
thought  necessary  to  provide  a  test  of  the  LEDs  and  GO/FAIL  placards  prior  to  displaying 
the  codes.  Hence  the  first  'code'  in  the  table  was  set  to  all  binary  ones,  the 
associated  nount  being  the  number  of  times  the  unit  had  been  switched  on.  Also,  to 
differentiate  between  eight-  bit  codes  and  eight-bit  counts  on  the  eight-bit  LED  display, 
both  GO  and  FAIL  placards  were  lit  to  denote  a  code,  while  the  GO  placard  only  was  lit 
to  denote  a  cc  nt . 

In  operation,  the  first  press  of  the  Ground-Check  button  caused  the  first  'Fault- 
code  of  'all  ones'  to  be  displayed,  and  both  GO  and  FAIL  placards  to  be  lit,  thus 
providing  a  test  of  all  lamps.  The  next  press  caused  the  number  of  power-ups  to  be 
displayed  with  the  GO  placard  only  lit.  The  third  press  caused  the  first  genuince  fault- 
code  (if  any)  to  be  displayed,  while  the  fourth  press  displayed  the  associated  count. 

This  procedure  was  followed  until  all  lamps  went  blank  indicating  end  of  readout,  the 
maximum  number  of  codes  being  27. 

The  Fault  Recorder  did  in  fact  detect  a  'sticky'  actuator,  the  associated  count 
increasing  more  rapidly  with  each  flight  until  eventually  the  actuator  seized. 

6.0  SOFTWARE 

6 . 1  Programming  Techniques 

6.1.1  Integrity 

The  very  stringent  integrity  requirement  of  no  software  errors  necessitates  the 
testing  of  every  possible  path  through  the  software.  With  a  program  length  of  over  7 
thousand  words  experience  has  shown  that  this  is  virtually  impossible  with  usual 
techniques.  Unrestrained  programming  at  assembler  or  machine-code  level  results  in  long 
programs  with  many  paths,  frequenctly  incomprehensible  to  any  but  the  original  programmer. 
Such  a  program  is  very  difficult  and  tedious  to  test  by  forcing  the  program  to  run  down 
ever}  possible  path,  and  proving  that  it  has  done  so.  Test  documentation  is  meaningful 
only  to  the  original  programmer  and  thus  virtually  useless,  while  modifications  can 
become  extremely  difficult.  Use  of  a  high-level  language  is,  if  anything,  even  worse 
than  assembler  level  programming.  The  compiler  itself  is  likely  to  have  errors  in  it 
(experience  with  compilers  in  this  respect  has  not  been  good)  and  thus  the  object  code 
must  be  tested,  but  without  a  flow  diagram  chis  is  an  impossible  task.  The  approach 
adopted  by  Rolls-Royce  was  modularity  in  the  form  of  subroutines.  Simple,  accurately- 
defined,  non-interactive  subroutines  at  the  lowest  level  were  used  to  build  up  subrout¬ 
ines  at  the  next  highest  level  and  so  on  (a  'hierarchical  modular  structure').  In  the 
interests  of  simplicity  the  subroutines  weie  single-entry,  single-exit,  and  were  also 
non-recursive. 

6.1.2  Basic  Subroutines 

The  subroutines  used  (Ref.  Appendix  1)  were  a  general-purpose  set,  not  engine- 
oriented,  to  provide  maximum  flexibility.  To  obtain  full  modularity  they  were  self¬ 
linking  so  that  no  subroutine  calls  were  required,  and  they  organised  their  own  data 
transfers.  Thus  to  the  user  they  appeared  to  be  very  powerful  multi-address  machine-code 
instructions.  For  example  overflow-protected  (saturating)  addition  is  written  merely  as:- 

ADD  (i.e.  Address  of  add  subroutine) 

A  (i.e.  Address  of  addend) 

B  (i.e.  Address  of  augend) 

C  (i.e.  Address  of  sum) 

This  is  known  as  the  calling  sequence,  and  is  all  that  is  required.  The  next  iter  in  the 
calling  sequence  is  the  address  of  the  next  subroutine.  Many  years  experience  at  Rolls- 
Royce  in  the  use  of  this  technique  has  siiown  that  it  has  many  desirable  features,  among 
which  are  :- 

a)  The  calling  sequence  is  machine-independent,  providing  portability  between 

different  machines. 

b)  The  user  is  relieved  of  .any  necessity  to  organise  data  in  the  subroutine's  working 

area  prior  to  subroutine  entry. 

c)  The  subroutines  can  be  used  to  write  very  complex  programs  quickly  and  easily,  with 

a  good  chance  of  being  error-free  prior  to  testing. 

d)  Most  important  for  this  application,  the  subroutines  can  be  very  thoroughly  tested 
and  then  used  with  complete  confidence.  As  an  example  of  testing,  the  "add"  subroutine 
was  specified  to  produce  the  maximum  positive  output  for  positive  overflow  and  maximum 
negative  output  for  negative  overflow.  It  therefore  had  three  internal  paths,  which  could 
in  principle  have  been  tested  with  three  pairs  of  numbers.  In  practice  eight  paths  were 
used,  four  to  check  4-quadrant  non-overflowing  addition  and  four  to  check  the  overflow 
ranges.  A  description  of  the  self-linking  and  data  transfer  functions  used  in  this  type 
of  subroutine  is  given  in  Appendix  1. 

o.l.  ’>  Functional  Subroutines 

The  basic  subroutines  were  used  to  build  up  the  functional  subroutines  at  the  next- 
hioho' t  level  in  the  hierarchy.  These  subroutines,  described  later,  were  :  - 

i)  Input  ;  li  )  On-Line  Monitor  ;  lii)  Reheat  Control  (Mot  described,  as  it  was  not  flown). 
I V )  Drv  Engine  Control:  v)  Data  store  Test;  vi )  Branch  Test;  vi i )  Output;  viii)  Ground  Chad, 
6,1.4  Executive  Program 

At  the  highest  level  of  the  hierarchy,  the  Executive  Program  organised  data  transfers, 
and  called  the  functional  subroutines.  In  the  process,  it  also  organised  the  double  Dry 
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Engine  Control  Subroutine  runs  to  provide  the  fault-detection  capability  for  the  Central 
Processor  and  part  of  the  Data  Store,  as  described  in  para.  6.4. 

6.2  Program  Store  Protection 

In  order  to  satisfy  the  store  safety  circuits,  it  was  necessary  to  ensure  that  the 
binary  sum  of  all  constants  and  machine-code  instructions  read  from  the  program  store 
during  any  one  sample  period  was  a  constant.  To  achieve  this  every  one  of  the  possible 
paths  through  the  complete  program  had  to  be  'padded'  using  'fetches'  of  appropriate 
constants.  With  thousands  of  possible  paths  through  the  control  program  alone,  this 
might  appear  to  be  a  difficult  task.  However,  the  programming  techniques  described  in 
the  previous  section  made  the  task  fairly  simple,  as  there  were  relatively  very  few  paths 
within  each  subroutine.  It  was  also  easy  to  decide  the  optimum  positions  for  the  padding 
constants  by  inspection,  although  a  formal  approach  had  been  devised.  It  was  decided 
that  each  basic  subroutine  should  internally  add  000116  to  the  store-adder  in  the  computer 
monitoring  circuitry  and  the  padding  constant  was  obtained  as  follows 

1)  The  sum  of  the  instructions  (including  the  pad  'fetch'  instruction)  was  obtained  using 
a  hexadecimal  calculator.  11)  The  carry  digits  (those  in  excess  of  16  bits)  of  the  above 
total  were  'wrapped  around'  to  match  the  store  adder.  For  example,  if  the  total  had  been 
12345x6,  in  the  16-bit  store  adder  the  *1'  would  have  been  added  to  the  least  significant 
digit,  giving  2346x6.  iii )  The  4-digit  total  above  was  subtracted  from  10000x6  (the 
desired  total  'unwrapped')  to  give  the  padding  constant.  For  the  above  example  this  is 
DCBA16.  When  running  a  program,  the  calling  sequence  for  the  subroutine  was  also 
automatically  added  into  the  store-adder  circuit.  Taking  ADD  as  an  example  again,  the 


calling  sequence  could  be  :- 

Calling  Sequence  Codm< 

ADD  0200 

A  3  COO 

B  3C02 

C  3C04 


The  total  of  this  calling  sequence  is  B606x6>  and  the  internal  padding  of  the  subroutine 
(0001x6)  brings  this  to  B60~i6.  In  order  to  pad  the  calling  sequence  to  the  desired  total 
(the  comparator  was  set  for  FFFF16)  a  special  pad  subroutine  was  written.  The  calling 
sequence  was 

PAD 

K 

and  its  only  function  was  to  fetch  K  from  store.  In  the  process,  of  course,  the  coding 
for  PAD  and  the  internal  padding  of  000116  were  also  added  into  the  store-adder  circuit. 
Padding  of  the  different  calling-sequence  paths  was  very  similar  to  padding  inside  a 
subroutine.  It  is  estimated  that  the  padding  added  about  10%  to  the  run-time,  a  small 
penalty  to  pay  for  nearly  100%  store  protection.  The  actual  protection  is  given  by  :- 

(1  -  1/216).100  =  99,998% 

6.3  Data  Store  Protection 

The  technique  used  for  program  store  protection  was  not  applicable  to  the  variable 
data  area.  Hence,  in  order  to  protect  incoming  data  from  store  faults,  each  input  was 
added  to  a  running  checksum  before  being  stored.  Then,  just  before  the  computer  sent  its 
output  to  the  actuators,  it  summed  the  input  data  with  the  Data  Store  Test  subroutine, 
and  compared  the  result  with  the  checksum.  The  delayed  input  data,  and  lags  calculated 
by  the  control  program,  were  protected  by  the  same  process  which  provided  the  Central 
Processor  Unit  monitoring,  described  in  para,  6,4. 

6.4  Central  Processor  Unit  Monitoring 

The  usual  C.P.U.  self-test  program,  where  the  computer  runs  through  its  instruction 
repertoire  with  selected  data,  was  considered  to  be  inadequate  by  the  Civil  Aviation 
Authority,  as  the  degree  of  protection  afforded  could  not  be  quantified.  Examination  of 
the  Dry  Engine  Control  Routine  showed  that  it  could  provide  adequate  checking  because 
most  instructions  were  used  many  times  over  with  virtually  random  data.  Hence  if  the  46 
partial  and  final  results  were  correct,  there  was  a  high  and  quantifiable  probability  that 
no  fault  was  present.  Several  possible  procedures,  including  a  run  of  the  control  program 
with  fixed  test  data  every  sample  period,  were  examined  and  the  procedure  finally  adopted 
was  as  follows  (see  also  Fig.  6) 

a)  At  power-up,  read  the  first  set  of  input  data,  then  run  the  control  program  (run  la), 
retaining  the  input  data  and  all  partial  and  final  results. 

b)  Follow  (a)  with  a  run  of  the  control  program  with  test  input  data  (Test  Run)  and 
check  the  test  results.  If  these  results  are  good  there  was  no  permanent  fault  during 
run  la. 

c)  On  receipt  of  the  next  Sampie-Rate-Clock  (SRC)  interrupt,  read  the  second  set  of 
input  data  and  run  the  control  program  (run  2a),  retaining  the  input  data  and  partial 
and  final  results. 

d)  Follow  (c)  with  a  run  of  the  control  program  using  the  first  set  of  input  data 
(run  lb)  and  compare  partial  anu  final  results  with  those  obtained  from  run  la.  If  they 
agree,  there  was  no  permanent  fault  during  run  2a,  and  no  transient  fault  affected 
either  run  la  or  run  lb. 

e)  On  receipt  of  the  next  SRC  interrupt,  read  the  third  set  of  input  data  and  run  the 
control  program  (run  3a). 

f)  Follow  (e)  with  a  run  of  the  control  program  using  the  second  set  of  input  data 
(run  2b)  and  compare  partial  and  final  results  with  those  obtained  during  run  2a.  If 
they  agree,  there  was  no  permanent  fault  during  run  3a,  and  no  transient  fault  affected 
either  run  la  or  run  lb.  This  'leapfrog'  process  is  repeated  indefinitely.  Because  a 
faulty  computer  obviously  cannot  be  relied  on  to  declare  itself  faulty,  the  comparison  is 
performed  in  the  hardware  comparator,  described  in  section  5.4,  rather  than  in  the 
computer  itself.  The  procedure  did  not  fully  check  the  condition  staticisers  (carry, 


overflow  etc.)  which  could  fail  dormant.  Thus  a  special  check  of  the  staticisers,  the 
Branch  Test,  was  incorporated  as  a  separate  subroutine.  The  'leapfrog'  technique  also 
protected  all  of  the  Data  Store  apart  from  the  new  data  area,  as  any  corruption  of  data 
would  produce  a  faulty  comparison  check. 

6.5  Operating  System 

Clearly,  from  the  testing  and  padding  requirements,  the  programmers  required  an 
intimate  knowledge  of  the  numeric  coding  and  could  expect  little  assistance  from 
assemblers  and  the  like.  Thus  it  was  decided  from  the  outset  to  dispense  with  most  soft¬ 
ware  aids,  and  to  hand-code  the  subroutines  and  calling  sequences  in  4-digit  hexadecimal 
format.  Although  slightly  tedious  this  was  not  a  difficult  task,  especially  as  the 
machine-code  for  the  Sanders  computer  used  4-bit  fields  throughout.  Paper  tapes  were 
prepared  on  a  teleprinter  and  loaded,  via  a  high  speed  reader,  with  a  simple  hexadecimal 
loader  which  was  permanently  resident  in  the  computer.  This  loader  also  checked  the 
characters  for  parity  errors.  In  order  to  prevent  undocumented  software  changes,  no 
paper-tape  punch  was  attached  to  the  system,  and  therefore  the  store  could  not  be  dumped. 
Hence,  although  modifications  could  be  entered  by  hand  for  test  purposes,  permanent 
alterations  had  to  be  entered  on  tape.  This  was  done  by  updating  a  master  tape,  so  all 
modifications  were  recorded  on  the  teleprinter  typeout.  It  is  known  that  this  lack  of  a 
pump  facility  did  in  fact  prevent  undocumented  modifications.  The  only  software  aid  used 
was  a  program  known  as  the  Diagnostic.  Controlled  by  the  switches  on  the  Operators 
Control  Panel,  it  ran  one  basic  subroutine  at  a  time,  and  could  display  the  address  where 
it  had  stopped,  the  result  (if  any)  of  the  previous  subroutine  and  the  cumulative  sum  of 
the  program  store.  The  Diagnostic  proved  to  be  very  valuable,  as  it  was  possible  to  step 
rapidly  through  long  programs,  and  the  padding  was  easy  to  check. 

6.6  Initialisation  Subroutine 

The  purpose  of  this  simple  routine  was  to  clear  counts,  fault  markers  etc.  to 
obtain  correct  operation  of  the  other  routines  on  power-up  or  fault  recovery.  It  also 
started  the  frequency- to- digital  converters  ready  for  the  first  run  of  the  Input  Routine. 

6.7  Input  Subroutine 

This  routine  read  all  inputs  including  the  normal  115V  400  Hz  power  supply  amplitude, 
forming  the  running  checksum  as  it  proceeded.  It  then  used  the  power  supply  amplitude  to 
correct  the  400  Hz  transducer  readings  and  derived  the  rates-of-change  of  the  pilots  lever 
angle  and  jet-pipe  temperature,  for  use  in  the  control  program, 

6.8  On-Line  Monitor  Subroutine 

The  safety  philosophy  was  that  the  computer  should  monitor  all  the  variable  inputs 
and  outputs,  and  that  a  short  transient  fault  should  not  cause  a  lane-change.  To  do 
this,  several  different  techniques  were  employed 

a)  Direct  Comparison.  On  Concorde  there  are  two  pilot's  lever  pick-offs  per  control 
lane,  the  outputs  of  which  can  be  compared. 

b)  Rate  of  Change.  Most  engine  and  airframe  parameters  have  a  rate  of  change  which  is 
limited  by  physical  considerations,  for  example  spool-speed  rates  are  limited  by  inertia. 
Thus  if  a  reading  changes  faster  than  physically  possible  then  that  reading  is 
recognisable  as  faulty. 

c)  Out  of  Range,  A  reading  is  obviously  faulty  if  it  is  outside  the  possible  range  of 
that  parameter. 

d)  Indirect  Comparison.  The  two  spool-speeds  and  the  jet-pipe  temperature  are  all 
related,  and  crude  but  effective  '.nter-comparisons  can  be  made.  Caution  is,  howeve.. , 
necessary  as  it  was  discovered  th<.+  if  an  engine  is  shut-down  in  flight  it  can  windmill 
at  high  RPM  while  the  jet-pipe  temperature  drops  rapidly  towards  zero. 

e)  Sign  Correlation,  This  technique  was  used  to  check  the  actuators  -  the  actuator 
velocity  pick-offs  should  normally  follow  the  actuator  drives.  Because  of  actuator  over¬ 
shoot  under  certain  conditions,  however,  the  tolerances  and  limits  proved  to  be  extremely 
difficult  to  set  up,  although  satisfactory  operation  was  eventually  obtained.  This  is, 
perhaps,  an  area  where  hardware  fault  detection  would  be  more  suitable  with  this  type  of 
actuator.  A  further  point  about  the  actuator  safety  is  that  if  a  fault  is  detected,  of 
necessity  the  actuator  is  frozen.  Therefore,  in  order  to  recover  from  a  transient  fault 
the  actuator  must,  after  a  short  delay,  be  unfrozen  and  tried  again.  A  unique  code  was 
assigned  to  each  of  the  27  possible  fault  sites  and  each  time  a  fault  was  detected  the 
appropriate  code  was  stored  in  a  table,  and  an  associated  count  incremented  by  1.  This 
code  was  later  retrieved  as  explained  in  para.  6.4. 

6.9  Dry  Engine  Control  Subroutine 

One  of  the  conditions  of  flight  clearance  for  the  digital  controller  was  that  it  should 
not  adversely  affect  the  normal  development  flying  of  the  aircraft  (Concorde  202).  Thus 
the  analogue  unit's  control  functions  and  test  procedures  were  copied  as  closely  as 
possible,  even  though  this  approach  did  not  fully  exploit  the  potential  of  digital 
control.  Development  of  the  Olympus  593  and  its  control  laws  had,  by  1976,  resulted  in 
a  very  complex  control  system.  Although  lack  of  space  precludes  a  detailed  description 
some  idea  of  the  complexity  can  be  gained  from  the  fact  tnat  there  were  25  individual 
^  control  loops  associated  with  the  fuel-flow  control,  and  9  more  loops  associated  with 

the  primary  nozzle,  together  with  the  associated  selection  logic.  Most  of  these  loops 
were  themselves  quite  complex,  with  non-linear  multi-parameter  schedules,  and 
considerable  interaction  between  them. 

6.10  Data  Store  Test  Subroutine 

This  test,  performed  immediately  after  the  first  run  of  the  Dry  Engine  Control 
Subroutine,  was  incorporated  to  ensure  that  that  program  had  been  run  with  correct  data. 
This  subroutine  summed  the  input  data  and  compared  this  sum  with  the  running  checksum 
:  formed  by  the  Input  Subroutine,  In  this  particular  case  it  is  permissible  to  perform 
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the  comparison  within  the  computer  -  if  the  Central  Processing  Unit  is  faulty  the  worst 
it  can  do  is  to  declare  a  non-existant  data  store  fault.  A  persistent  Central  Processor 
Unit  fault  would,  in  any  case,  be  detected  by  the  'leapfrog'  technique  described  in  para. 
6.4  or  by  the  Branch  Test  subroutine,  para.  6.11. 

6.11  Branch  Test  Subroutine 

The  staticisers  (sign,  overflow,  carry,  non— zero)  upon  which  the  conditional 
branch  instructions  operate,  may  remain  in  one  state  for  several  sample  periods..  Hence, 
if  one  of  them  fails  without  changing  state  the  fault  will  not  be  detected  by  the  'leap¬ 
frog'  technique.  This  subroutine  therefore  set  the  four  staticisers  to  all  possible  16 
conditions,  and, for  each  condition,  tested  all  18  conditional  branches  in  the  computer. 

6.12  Output  Subroutine 

Considerable  difficulty  was  experienced  with  the  actuator  velocity  drives,  which 
had  only  20  quantisation  levels.  This  resulted  in  a  very  high  apparent  gain  across  the 
actuator,  requiring  a  corresponding  very  small  gain  (a  nominal  -l/16th)  in  the  computer. 

If  this  gain  is  plotted  as  shown  by  the  solid  line  in  Fig. 7,  it  can  be  seen  that  there 
are  large  discontinuities  and  a  deadbana.  It  was  found  that  the  actuators  tended  to 
become  'trapped'  in  the  notch  at  23  bits  control  output,  tripping  the  On-Line  Monitor 
program.  Thus  the  gain  curve  was  modified  as  shown  by  the  dotted  line,  which  provided 
a  satisfactory  solution.  The  effect  of  the  deadband  was  beneficial  on  most  of  the 
control  loops;  it  was  small  enough  to  provide  satisfactory  control  while  at  the  same  time 
it  prevented  actuator  'jitter'.  However,  it  was  too  large  for  the  get-pipe  temperature 
limiter,  where  the  deadband  was  28°C.  The  solution  adopted  was  to  arrange  that  when  this 
loop  entered  the  deadband  the  gain  was  switched  from  -l/16th  to  -1,  with  a  very  slow 
actuator  velocity  limit  imposed.  This  resulted  in  the  limiter  loop  cycling  slowly  by 
about  _+l°C  around  the  required  datum  -  well  within  tolerance. 

6.13  Ground  Check  Subroutine 

The  Ground-Check  was  controlled,  as  described  in  para.  3.5,  by  a  three-position 
switch  labelled  'A',  'PFR'  and  'B',  eight  light-emitting  diodes  (LEDs),  a  green  'GO' 
placard  and  a  red  'FAIL'  placard  mounted  on  the  front  of  the  unit.  Previous  examples  of 
ground-check  had  run  the  program  at  base  level,  the  sample-rate-clock  and  safety  circuits 
being  serviced  by  a  dummy  interrupt  routine.  This  practice  was  thought  to  be  potentially 
dangerous  for  a  flight  system  -  a  situation  can  be  envisaged  where  the  computer  is  running 
incorrectly  at  base  level,  while  correctly  servicing  the  safety  circuits  at  interrupt  level. 
Hence  the  Ground-Check  program  was  time-slotted  and  run  at  interrupt  level.  It  was, 
therefore,  also  necessary  to  pad  the  program  as  described  in  para.  6.2.  During  previous 
demonstrations  of  ground-checK  the  comment  had  been  made  that  'there's'  no  proof  that  it's 
doing  anything.  Hence,  on  this  system  the  eight  LEDs  were  made  to  count  up  rapidly, 
while  the  green  'GO'  placard  flashed  slowly.  This  appeared  to  constitute  proof  that  the 
system  was,  in  fact,  checking  itself  as  no  adverse  comments  were  made.  The  primary 
function  of  the  ground-check  was  to  check  the  safety  circuits  for  dormant  faults,  but  as 
a  demonstration  that  the  system  could  check  itself,  other  tests  for  faults  which  would  be 
dormant  before  the  engine  was  started  were  incorporated.  On  a  commercial  aircraft  these 
could  perhaps  be  performed  before  passenger  embarkation.  The  best  test  of  the  safety 
circuits  was  to  check  that  they  could  'freeze'  the  actuators.  Hence,  in  order  to 
differentiate  between  actuator  faults  and  safety  circuit  faults  it  was  necessary  to  first 
check  the  actuators  for  correct  movement.  The  actual  checks  were  as  follows 

a )  'A'  Checks 

i)  Drive  actuators  closed  onto  end  stops  to  establish  a  datum, 
ii)  Check  position  pick-offs  for  end-stop  position, 
lii)  Drive  actuators  open,  checking  position  and  taoho  pick-offs  against  each  other. 

iv)  Drive  actuators  nearly  closed,,  again  checking  position  and  tacho  pick-offs, 

v)  Activate  each  safety  circuit  in  turn,  checking  that  when  activated  the  actuators 

cannot  bo  driven,  and  that  when  de-activated  they  can  be  driven  (allowing  sufficient 
time  between  checks  to  allow  the  fault  integrator  to  count  down), 

vi)  Operate  relay  to  inject  test  frequency  into  spool-speed  probes  (continuity  check) 
and  check  frequency-digital  converters  (accuracy  check).  Release  relay  and  check 
that  test  frequency  is  removed. 

vii)  Check  T1  (intake  temperature)  and  Ij  (jet-pipe  temperature).  Originally  it  was 

intended  to  compare  T1  and  Tj,  but  ao  there  was  a  possibility  of  the  engine  being 
hot  when  testing,  a  'credibility'  check  was  u-el, 
vin)  Score  sum-check. 

b)  1 B  '  Checks 

Activate  a  safety  circuit  and  start  a  software  timer.  Check  that  the  timer  does 
not  reach  1.5  sec.  If  it  does,  either  the  fault  integrator  or  tne  final  depower  relay 
is  faulty.  In  the  interests  of  safety,  software  interlocks  were  incorporated  to  prevent 
testing  if  the  engine  was  running,  or  to  abort  testing  if  the  engine  was  started  during 
a  tost. 

6.14  Fault-Code  Readout 

For  convenience,  the  fault-code  readout  was  incorporated  in  the  Ground-check  sub¬ 
routine.  All  ?7  possible  fault -sites  were  allocated  a  unique  code,  and  whenever  a  fault 
was  detected  the  code  was  stored  in  a  fault  table  and  an  associated  count  incremented. 

This  perritted  information  to  be  stored  about  permanent,  transient  and  intern ittent  faults, 
lo  'distinguish  between  fault  codes  and  counts  on  the  8-bit  LED  display  (Fig. 3),  both  'Go' 
and  TAIL'  placards  were  ill  mated  for  a  Code,  while  for  a  count  the  To'  placard  only 
was  lit.  In  addition  a  power-up  was  claddifiod  as  a  'fault',  the  fault-code  being  all 
ones  (to  test  tne  LEDs).  kith  the  J-position  switch  in  the  ';VK'  (Post-ilioht  Readout  i 
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position,  a  press  of  the  'Ground-Check'  push-button  caused  the  computer  to  search  the 
fault-code  store.  The  first  code  encountered  was  the  all  ones  pov.'er-up  code,  causing 
all  8  LEDs,  the  'GO'  and  'FAIL'  placards  to  be  illuminated.  The  next  press  of  the 
button  caused  the  number  of  power-ups  to  be  displayed,  with  only  the  'GO'  placard  lit. 
Further  presses  caused  further  fault-codes  and  counts  (if  any)  to  be  displayed  until  all 
lamps  were  extinguished  to  indicate  'end  of  readout'. 


7.0  FLIGHT  CLEARANCE 

It  was  not  possibic  to  dedicate  the  British  development  aircraft,  Concorde  202,  to 
flight  trials  devoted  solely  to  the  controller.  Firstly,  the  cost  would  have  been  pro¬ 
hibitive  and  secondly,  the  aircraft  was  being  used  intensively  for  other  purposes. 
Permission  to  fly  the  controller,  on  a  'free-ride'  basis,  was  granted  only  on  condition 
that  it  did  not  interfere  with  the  aircraft's  normal  development  flying.  Thus  it  was 
vital  that  the  controller  performed  eyactly  as  the  existing  analogue  system  and  that  it 
did  not  produce  radio  frequency  interference.  It  was  also  important  that  the  controller 
should  not  fail,  due  either  to  radio  frequency  interference  from  other  equipment  or  to 
an  internal  fault.  Hence  the  appropriate  parts  of  the  normal  tests  for  avionic  equipment 
were  applied.  One  of  the  three  controllers  was  subjected  to  severe  temperature  cycling 
and  vibration  tests,  followed  by  a  strip-down  and  visual  check.  Of  the  other  two,  one 
was  subjected  to  EMC  (Electro-Magnetic  Compatibility)  tests,  and  both  received  R.S.T. 
(Reliability  Shakedown  Testing).  No  problems  were  encountered  during  testing,  even  the 
EMC  tests  being  passed  easily.  This  was  rather  surprising  in  view  of  considerable 
pessimism  in  many  quarters  concerning  the  vulnerability  of  computers  to  radiation,  and 
was  presumably  the  result  of  good  design.  One  unit  was  subjected  to  bench  pass-off  tests 
on  a  rig  used  to  pass-off  the  analogue  controllers.  This  cleared  it  to  run  an  engine  on 
a  test-bed,  where  it  was  subjected  to  an  exhaustive  series  of  tests  to  clear  it  for  flight. 


8-0  FLIGHT  TRIALS 

The  flight-cleared  controller  has,  to  date,  completed  some  25  hours  of  flyii  g  and 
approaching  some  100  hours  of  engine  running  on  seven  different  engines.  Despite  a.' 1  the 
careful  testing,  three  minor  initial  problems  appeared  on  the  aircraft.  These  were  : - 

i)  On  changeover  from  aircraft  to  ground  power,  the  unit  was  subjected  to  an 
unexpected  transient  power  interrupt,  with  a  very  slow  voltage  recovery.  This  corrupted 
the  core-store  contents,  which  resulted  in  the  safety  circuits  operating  and  changing 
lanes.  The  fault  was  found  to  be  due,  not  to  the  core-store  itself,  but  to  an  error  : n 
the  piwer-up  sequencing  which  had  not  been  revealed  by  the  bench  power-interrupt  tests. 

It  is  of  interest  to  note  that  no  problems  were  encountered  with  the  core-store.  In 
fact,  the  power-up  sequencing  error  was  the  only  hardware  fault  encountered  during  all 
the  engine  running  and  flight  trials. 

ii)  The  IIP  spool-speed  signal  on  the  aircraft  was  noisier  than  on  the  test-bed.  The 
only  result  of  this  was  an  occasional  flicker  of  the  auto-ignition,  which  was  easily 
cured  in  the  software. 


iii)  During  an  engine  relight  test  on  the  edge  of  the  relight  envelope,  the  engine  took 
a  considerable  time  to  relight.  Just  before  relight  the  'Tj  FAIL'  placard  on  the  flight- 
deck  flashed.  Such  a  failure  is  not  serious,  as  the  controllers  continue  operation  in 
this  condition.  This  problem  was  traced  to  the  software  intercomparison  of  Nh,  Nl  and 
Tj.  Although  normally  a  good  test  of  TJ,  it  had  not  been  appreciated  that  the  engine 
could  windmill  at  very  high  RPM  with  a  very  low  (nearly  down  to  0°C)  jet-pipe  temperature. 
This  test  was  deleted,  reliance  being  placed  on  the  existing  out-of-range  test.  Apart 
from  these  minor  teething  problems,  the  unit  has  been  flown  over  most  of  the  flight 
envelope  cf  the  aircraft  with  no  further  problems.  During  the  flight  trials  the  Fault 
Code  Readout  revealed  an  intermittently-sticking  nozzle  actuator,  the  fault-count 
increasing  more  rapidly  with  each  flight.  At  the  time  it  was  not  certain  if  there  was  a 
genuine  fault  or  if  the  safety  was  over-sensitive.  The  digital  controller  was  therefore 
moved  to  another  engine,  where  the  fault  disappeared.  Subsequently  the  original  actuator 
seized-up  and  had  to  be  changed.  This  experience  revealed  the  potential  usefulness  of 
the  Fault-Code  Store.  The  unit  has  also  been  used  twice  to  assist  in  engine  development. 
The  requirements,  impossible  to  meet  manually,  were  in  addition  to  the  normal  control 
funtions  but  were  readily  incorporated  in  the  software,  no  hardware  changes  being 
requ i red. 

9.0  FUTURE  TRENDS 

9. 1  Computer  Monitoring 

The  advent  of  microprocessors  and  high-density  stores  has  rendered  the  monitoring 
techniques  employed  m  the  controller  obsolete.  Current  thinking  is  that,  at  least  for 
military  applications,  a  microcomputer  can  be  monitored  by  another,  identical  micro¬ 
computer  running  in  exact  synchronisation.  If  a  microcomputer  with  serial  unidirectional 
highways  is  used,  then  the  input  highways  can  be  paralleled  together,  to  ensure  that  both 
microcomputers  receive  the  same  data.  All  that  is  required  on  the  output  highways  is  a 
one-bit  comparator.  Of  course,  a  device  such  as  a  watchdog  timer  is  still  required  for 
common-mode  faults  such  as  clock  failure.  A  system  of  this  type  has  been  built  and  soak- 
tested  for  over  1000  hours  with  no  problems  at  all,  although  subsequently  a  self- 
‘-vnehronising  feature  was  added  to  permit  recovery  from  possible  transient  loss  of 
synchronisation.  For  civil  applications  it  is  likely  that  the  airworthiness  authorities 
will  insist  on  dissimilar  microcomputers.  The  same  technique  can  still  be  applied,  but 
is  considerably  more  complicated. 

9 . 2  Failure  Detection  and  Survival 

Traditionally,  engine  controllers  have  consisted  of  two  separate  lanes  of  control. 
In  any  one  lane  it  is  not  possible  to  detect  some  forms  of  fault,  (for  example  drift), 
and  lull  use  is  not  made  of  the  available  redundancy.  If,  however,  the  highways  of  a 


digital  system  are  interconnected  through  suitable  electrical  isolators  as  shown  in  Fig. 

8  then  the  controlling  computer  has  access  to  both  sets  of  transducers.  Consequently 
it  can  detect  all  previously  undetectable  faults  by  direct  comparison  and,  although  in 
these  cases  it  cannot  locate  the  faulty  transducer,  it  can  store  a  fault-code  and  use 
some  predetermined  failure  strategy,  depending  on  the  aircraft  type.  For  example,  on  a 
vertical  take-off/landing  aircraft  it  can  use  the  reading  giving  the  highest  thrust,  or 
on  a  multi-engines  aircraft  it  could  fail  frozen  and  warn  the  crew,  who  can  take 
appropriate  action.  The  availability  of  both  sets  of  transducer  readings  also  improves 
failure  survival.  In  previous  systems  a  failure  in  the  controlling  lane  followed  by 
another  in  the  standby  lane  resulted  in  system  failure.  With  the  interconnection,  how¬ 
ever,  the  only  faults  which  fail  the  system  are  those  of  identical  pairs  of  elements, 
e.g.  a  pair  of  transducers,  a  pair  of  computers  etc.  Typically,  this  feature  improves 
failure  survival  by  some  5-10  times. 

9. 3  Simplex  and  Triplex  Functions 

On  many  systems }  simplex  functions  such  as  reheat  are  required.  These  are  readily 
accommodated  in' the  highway  interconnections  as  shown  in  Fig. 9.  Future  engine  control 
systems  will  probably  be  required  to  interface  with  triplex  highway  systems.  Obviously, 
with  three  electrically  isolated  sets  of  inputs  and  outputs,  no  difficulty  would  be 
experienced  with  this  type  of  system. 

9.4  System  Survivability 

The  interconnected  arrangement  has  the  advantage  that  it  can,  if  required,  be 
physically  separated  into  two  units,  or  three  with  reheat,  thus  enhancing  survivability 
from  battle-damage  and  fire. 

10,0  CONCLUSIONS 

So  far  as  is  known,  this  was  the  first  exercise  of  its  kind,  and  there  were  no 
guidelines  to  follow.  Thus  the  emphasis  was  on  caution  and,  above  all,  simplicity.  The 
use  of  interrupts  (other  than  the  Sample  Rate  Clock)  and  Direct  Memory  Access  was  avoided, 
as  were  programming  techniques  such  as  multi-sample-rate  working  and  (other  than  for 
Ground-Check)  time-  slotting.  It  is  thought  that  the  success  of  the  project  was  largely 
due  to  this  simplistic  approach  -  efforts  could  be  concentrated  on  the  real  problems,  of 
which  there  were  many,  rather  than  potential  problems  introduced  by  complexity.  It  is 
clear  that  considerable  caution  is  necessary  when  introducing  full-authority  digital 
control  -  even  this  system,  based  on  an  existing  analogue  controller,  was  not  entirely 
trouble-free.  The  success  of  the  project  demonstrated  the  feasibility,  flexibility  and 
capability  of  digital  control.  However,  as  the  units  were  built  on  an  experimental 
basis,  production  costs  were  not  known.  The  subsequent  development  of  microprocessors, 
of  course,  has  altered  the  situation  considerably;  an  equivalent  system  now  would 
undoubtedly  be  smaller  and  cheaper  than  the  current  analogue  system. 
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APPENDIX  1 

Self-Linking  Subroutine  Internal  Organisation 

The  most  common  organisation,  suitable  for  most  machines,  is  to  use  a  pointer  which 
points  to  the  next  required  item  in  the  calling  sequence.  Thus,  for  example,  if  the 
calling  sequence  is 

Calling  Sequence  Comments 

ADD  Address  of  ADD  subroutine 

A  Address  of  addend 

B  Address  of  augend 

C  Address  of  sum 

NEXT  Address  of  next  subroutine 

X  Data  address 

then,  after  entry  into  the  ADD  subroutine  the  pointer  value  will  be  1001.  Internally 
the  functions  could  be  :- 

Fetch  contents  of  pointer,  i.e.  A 

Increment  pointer 

Fetch  contents  of  A,  i.e.  addend 

Fetch  contents  of  pointer,  i.e.  B 

Increment  pointer 

Fetch  contents  of  B,  i.e.  augend 

Perform  add  function  (form  sum) 

Fetch  contents  of  pointer,  i.e.  C 

Increment  pointer 

Store  sum  in  contents  of  C 

Fetch  contents  of  pointer,  i.e.  NEXT 

Increment  pointer 

Jump  to  NEXT,  i.e.  enter  next  subroutine.. 

On  entry  into  the  next  subroutine  the  pointer  value  will  be  1031,  the  addrest  if  the 
first  data  address  for  the  next  subroutine.  Clearly  the  internal  functions  canbbe 
tailored  to  suit  the  abilities  of  the  particular  machine;  for  example  a  machine  could 
have  an  instruction  which  increments  the  pointer  then  fetches  its  contents,  ir.  one 
operation.  Initial  entry  into  the  calling  sequence  must  set  up  the  correct  initial 
value  for  the  pointer.  Frequently  the  machine's  own  subroutine  call  will  do  this 
automatically,-  If  not,  a  special  subroutine  is  necessary. 
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2A.  Subroutine  Used 

CALLING  SEQUENCE 

ADD/A/B/C 

SUB/A/B/C 

MULT/A/B/s/C 

DIV/s/A/B/C 

MOD/A/X 

NEG/A/X 

SHIFTA/s/A/X 

VBS/X/TAB/Y 

HWS/ TABX/X/TABY/Y 

LWS/TABX/X/TABY/Y 

INTEG/A/B/s/X 

SQRT/A/B 

SHIFTL/s/A/X 

AND/A/B/X 

OR/A/B/X 

TRANS/A/X 

DELAY/A/X/Y 

MOVE/XABX/ TABY 

SWAP/TABX/TABY 

READ/TAB/ J/X 

STORE  /A/TAB/J 

PASS 

JUMP/L 

JUMPI F/ A/B/L 1/L2/L3 


JUMPS/TAB/ J 
SWI TCH/X/m/Ll /L2 

SUBR/N/L 

EXIT/N 

SERVICE/t 

WAIT 

ADC/ a  /X 

DAC/X/c 

ACT/X/n/a 

CPUSC 

PAD/k 

RCS/SUM 

TCS/TAB/SUM 

COMPT/TABA/L 


FUNCTION 

Overflow  -  protected  addition 
Overflow  -  protected  subtraction 

Overflow  -  protected  multiplication  (s  =  scaling  factor) 
Overflow  -  protected  division  (s  =  scaling  factor) 
Overflow  -  protected  modulus 
Overflow  -  protected  negate 

Overflow  -  protected  arithmetic  shift (s  =  shift  factor) 

Variable  break-point  schedule  ("function  generator") 

Highest  wins  (TABX  =  data  address,  TABY  =  associated 
codes ) . 

Lowest  wins 

Double-length  integrator 
Special-purpose  square  root 
Logical  shift 
Logical  AND 
Logical  inclusive  'OR' 

Transfer  (A)  to  (X) 

(A)  (X),  then  (X)  (Y) 

Move  table  X  to  table  Y 

Swap  tables  X  and  Y 
Read  jth  item  from  table 
Write  into  jth  table  place 
No  operation 

Unconditional  relative  jump 

Conditional  relative  jump 

LI  if  A  !< 

L2  if  A  =  B 

L3  if  A  B 

Relative  jump  to  jth  address  in  table 

Relative  jump  to  LI  if  x  m  =  0 
L2  if  x  m  /  0 

Enter  subroutine  at  location  L 
Store  link  in  location  N, 

Exit  subroutine 

Response  to  clock  interrupt.  Set  sample  period  to  t. 
Wait  for  next  clock  interrupt 

Analogue  input  from  channel  a  (Right  justified) 

Analogue  output  to  channel  a  (overflow  protected) 
Actuator  drive  to  channel  a,  limited  to  n  pulses. 

CPU  staticiser  check. 

Read  k  from  store. 

Running  Checksum.  Add  R1  to  (SUM). 

Table  checksum. 

Compare  tables.  Jump  to  L  if  not  o<  lal. 


ig.  1  Digital  controller 
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Fig.4  Computer  monitoring  system 
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Fig. 6  Processor  arithmetic  monitoring  procedure 
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Fig.8  Interconnected  digital  system 
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Fig. 9  Simplex  reheat  in  interconnected  system 
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DISCUSSION 


R.Cocking,  UK 

Could  you  please  comment  on  the  reliability  of  the  software? 

Author’s  Reply 

In  this  type  of  system  there  must  be  no  software  errors.  This  can  only  be  achieved  by 

1 .  a  very  high  standard  of  documentation, 

2.  thorough  testing  at  all  levels,  and 

3.  no  means  of  permanently  altering  the  program  with  no  record. 

The  program  was  written  and  tested  early  in  1976  and  we  have  yet  to  find  a  fault.  Several  thousands  of  hours  of 
testing  have  taken  place,  a  considerable  time  using  the  control  unit  as  a  development  tool  both  in  aircraft  and  on  the 
test  bed. 


R.Cocking,  UK 

Could  you  comment  on  the  fault  integration  technique  compared  with  “freeze  on  third  consecutive  fault”  used  by 
W.T.Mitchell  on  the  space  shuttle. 

Author’s  Reply 

The  fault  integrator  was  specifically  designed  to  provide  the  exact  change-over  response  under  lane  failure  conditions 
as  its  analogue  counterpart,  e.g.  the  automatically  changeover  occurred  1 .5  seconds  after  detection  of  a  permanent 
fault. 

I  believe  that  in  using  an  up-down  counter  arrangement  as  in  the  Concorde  System,  it  provided  a  more  graceful 
degradation  of  the  system.  In  the  SSME  control  using  Liquid  Hydrogen/Oxygen  the  demarcation  between  operating 
and  the  need  to  shutdown  is  very  critical.  Thus  should  a  device  “strike”  3  consecutive  times  it  will  be  declared  failed 
and  permanently  disqualified,  e.g.  60  milliseconds. 


A.A.Martino,  US 

Describe  what  parameters  you  measured  to  determine  what  you  noted  as  “Engine  Life  Recording” 

Authors  Reply 

The  engine  life  recorder  was  based  on  the  Pegasus  engine  and  is  concerned  mainly  with  recording  stress  in  the  engine 
components  which  tend  to  limit  time  between  overhauls.  The  programming  effort  in  the  Concorde  control  system 
concentrated  on  producing  a  program  capable  of  recording  cycle  damage,,  whether  it  be  for  speed  or  temperature 
cycles  and  creep  life. 

Thus  the  life  recorder  program  indicating  speed  cycle  fatigue  and  creep  life  occupied  450  words  and  an  execution 
time  of  500  p  sec. 

Parameters  were  Njj  and  Tj  available  in  the  control. 


J.Peikert,  Ge 

( 1 )  Controller  Mounting.  Engine  mounted  or  A/C  mounted? 

(2)  Environmental  Testing.  Extremes  of  temperature,  vibration  and  EMC  testing,  with  especial  interest  in 
HF-susceptibiiity.  What  are  the  max  field  strength  in  v/m,  to  which  the  controller  has  been  tested? 

Author’s  Reply 

(1)  Airframe  mounted  in  a  1/2  ATR  long  case. 


(2)  lest  extremes  are' 

Upper  temperature  +  70°C 
Lower  temperature  —  40°C 


Operational 


Normal  acceleration  level  was  8.25  g  (5.5  g  factored  by  1 .5)  in  3  planes  each  at  1  minute  minimum. 

Survival  ac;eleration  10  g  for  1  minute. 

Radio  interference  test  complied  to  SB/8/07-5001-01*  Test  27,  iss  1  for  susceptibility  and  suppression 
Transient  voltage  test  in  accordance  with  SB/8D/5010-01  *  App.A.  Amend. 4  or  SB/8/07-5001  01  *  Test  29  iss.  1 
Field  strengths  of  10  V/m 
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ABSTRACT 

The  TORNADO  is  equipped  with  two  accessory  drive  gearboxes  which  operate  hydraulic 
pumps,  f1  ■>!  back-up  pumps  and  electric  generators.. 

The  gearboxes  are  driven  either  by  the  APU  via  the  APU-clutch  or  by  the  aircraft 
engines.  A  second  clutch,  the  CD-clutch,  allows  the  mechanical  connection  of  both  gear¬ 
boxes  . 

The  automatic  starting  cycle  of  the  APU,  operation  of  the  accessory  drive  gearboxes 
under  well  defined  speed-  and  acceleration  conditions  and  the  starting  phase  of  the 
aircraft  engines  are  controlled  and  monitored  by  the  Secondary  Power  System  Control 
Unit,  an  electronic  subsystem. 

If  a  failure  occurs  during  system  operation  the  control  unit  opens  the  corresponding 
clutch  or  shuts  down  the  APU,  stores  and  displays  the  type  of  failure  on  LED  indicators 
and  actuates  the  master  alarm  on  the  maintenance  panel. 

The  control  unit  is  equipped  with  built-in  test  features  for  a  1  ■  internal 
protection  circuits  and  for  external  sensors  and  transducers. 


1.  INTRODUCTION 

In  order  to  fully  understand  the  operation  of  the  Secondary  Power  System  Control 
Unit  -  abbreviated  SPSCU  -  we  must  first  take  a  close  look  at  the  Secondary  Power  System 
itself . 


APU  Auxiliary  Power  Unit 

IDG  Integrated  Drive  Generator 

HP  Hydraulic  Pump 

FBP  Fuel  Backing  Pump 
TC  Torque  Converter  with  Freewheel 

PTO  Power  Take  Otf 

Fig.  1 

The  Secondary  Power  System 
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The  PANAVIA  TORNADO  Aircraft  is  equipped  with  two  Gearboxes  (GB)  which  are 
driven  by  the  two  Main  Engines.  Both  Gearboxes  primarily  fulfill  the  same  task  and 
are  nearly  identical  in  construction. 

Each  Gearbox  in  turn  drives  an  Integrated  Drive  Generator  (IDG),  a  Hydraulic  Pump 
and  a  Fuel  Backing  Pump,  thus  suppl/ing  the  TORNADO  AIRCRAFT  via  the  Secondary  Power 
System  with  electrical  and  hydraulic  power. 

Additionally,  both  Gearboxes  can  be  driven  by  an  Auxiliary  Power  Unit  (APU)  which 
ensures  the  full  function  of  the  Secondary  Power  System  on  the  ground  even  with  the  Main 
Engines  shut  down. 

The  APU  is  first  started  by  means  of  the  Aircraft  Battery  and  accelerated  to  nominal 
speed.  After  the  APU  has  reached  its  rated  RPM  the  APU-Clutch  engages  thereby 
accelerating  the  R/H  Gearbox  to  rated  speed.  Once  on  speed  the  R/H  Gearbox  can 
accelerate  and  drive  the  L/H  Gearbox  by  means  of  the  CROSS-DRIVE-CLUTCH  (CD-Clutch).  In 
this  way  the  Secondary  Power  System  can  be  operated  stationary  by  the  Auxiliary  Power 
Unit. 

When  starting  a  Main  Engine  the  Torque  Converter  in  the  corresponding  Gearbox  is 
filled  with  oil  and  the  engine  accelerates.  As  soon  as  either  engine  has  reached  60  %  of 
its  rated  RPM  the  APU  is  automatically  shut  down  and  the  APU-Clutch  opens.  The  Gearbox 
is  then  driven  by  the  Main  Engine. 

Normally,  during  flight  each  Main  Engine  drives  its  own  Gearbox.  However  in  case  of 
an  inflight  shut  down  of  a  Main  Engine  the  corresponding  Gearbox  can  be  automatically 
connected  to  the  remaining  engine  by  means  of  the  CD-Clutch.  This  guarantees  the 
redundancy  of  both  Gearboxes. 

All  Control  Functions,  Regulating  and  Monitoring  Functions  necessary  for  starting  and 
operating  the  APU,  for  accelerating  and  operating  both  Gearboxes  are  accomplished  in  the 
Secondary  Power  System  Control  Unit. 


2.  SECONDARY  POWER  SYSTEM  CONTROL  UNIT 

The  SPSCU  is  a  Line  Replaceable  Unit  which  -  due  to  its  different  functions  -  can  be 
subdivided  into  an  APU-Section  and  a  GB-Section. 


2.1  APU-SECTION 

The  APU-Section,  which  is  called  APU-Control  Unit  (APUCU),  controls  the  automatic 
starting  cycle  of  the  APU.  This  cycle  is  initiated  by  pressing  the  Starter  Button  in  the 
Cockpit. 

During  start  up,  acceleration,  and  after  successfully  attaining  rated  APU  RPM  the  APUCU 
monitors  the  normal  APU  operation  and  controls  the  following  external  devices: 

Air  Inlet  Door 

External  Fuel  Cock 

Master  Fuel  Valve 

Starter  Solenoid 

Ignition  Fuel  Valve 

Ignition  Unit 

APU  Start  Counter 

APU  Operating  Hours  Counter 

APU  Operating  Light  (Cockpit)  and 

Master  Alarm  (Maintenance  Panel) 

In  addition  to  the  above,  the  APUCU  also  monitors  the  following  APU  signals: 

Air  Inlet  Door  open 
External  Fuel  Cock  open 
APU  RPM 

Starter  Temperature  and 

Low  Oil  Pressure 

Should  one  of  the  signals  being  monitored  by  the  APUCU  behave  abnormally  or  should  it  be 
unable  to  reach  its  nominal  value  within  an  exactly  defined  time  period  the  APU  is 
automatically  shut  down  and  a  stored  Fault  Light  is  illuminated  on  the  front  plate  of  the 
Control  Unit. 

The  most  important  of  the  signals  being  monitored  by  the  APUCU  is  the  APU  RPM  signal. 
It  is  sensed  by  an  Inductive  RPM  Transmitter. 


i 


Fig.  2 

APU  Speed  Signal  Monitoring 


The  Starter  can  only  be  engaged  if  the  transmitter  does  not  sense  a  RPM  signal;  in 
other  words  the  APU  must  be  at  a  standstill. 

However,  should  the  sensed  RPM  frequency  be  insufficient  after  Starter  engagement  (tl) 
then  the  starting  cycle  is  automatically  aborted  as  the  danger  of  a  mechanical  Turbine 
Problem  or  a  defect  RPM  Transmitter  might  exist. 

As  soon  as  the  RPM  exceeds  the  second  Threshold  Value  the  Starter,  the  Ignition 
System  and  the  Ignition  Fuel  Valve  are  switched  off  and  the  APU  accelerates  by  its  own. 

An  electronic  interlock  prevents  reengaging  the  Starter  in  case  of  a  momentary  RPM  loss 
after  Starter  disengagement.  A  very  precise  Time  Monitoring  Circuitry  ensures  that  the 
APU  is  immediately  shut  down  if  the  necessary  RPM  for  disengaging  the  Starter  is  not 
attained  within  a  certain  time  period  (t2). 

A  third  RPM  Threshold  is  set  shortly  below  Rated  RPM.  When  the  RPM  reaches  this 
Threshold  the  Lubrication  Oil  Pressure  is  monitored  and  a  signal  for  closing  the  APU- 
Clutch  is  generated. 

A  decrease  in  RPM  below  the  Threshu'd  or  exceeding  the  time  measurement  t2  shuts  the 
APU  down  because  of  a  possible  overload  condition. 

A  fourth  RPM  Threshold  protects  the  APU  against  destruction  by  rapidly  shutting  it 
down  at  Overspeed. 

During  Starter  operation  the  Starter  temperature  is  sensed.  If  the  temperature  rises 
above  a  permissable  value  the  Starter  is  automatically  disengaged  and  cannot  be  reengaged 
until  cooled  down  to  a  safe  temperature.  In  this  case  the  APU  will  not  be  shut  down  and 
all  monitoring  circuits  will  stay  active.  This  ensures  the  normal  completion  of  the 
Starting  Cycle  if  sufficient  RPM  has  been  attained  prior  to  Starter  disengagement.  However, 
if  the  APU  has  not  yet  reached  enough  speed  to  accelerate  by  its  own  at  the  moment  of 
Starter  disengagement  then  any  of  the  afore  mentioned  Time  Monitoring  Circuits  will  shut 
the  APU  down  before  a  damage  might  occur. 


2.2  6B-SECTI0N 

The  GB-Section  (GBCU)  of  the  SPSCU  primarily  controls  and  regulates  the  function  of 
the  APU-Clutch  and  the  CD-Clutch.  Both  clutches  are  hydraulically  operated. 

The  following  input  signals  are  processed  in  order  to  fulfill  this  task: 

Oil  Temperature  R/H  Gearbox 
Oil  Temperature  L/H  Gearbox 
RPM  R/H  Gearbox 
RPM  L/H  Gearbox 
APU-Clutch  Pressure 
CD-Clutch  Pressure 
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In  addition,  the  GBCU  processes  the  following  discrete  Aircraft  command  signals: 

CO-AUTO/DISENGAGE 

CD-RESET 

Speed  Switch  R/H  Engine 
Speed  Switch  L/H  Engine 

The  main  responsibility  of  the  GBCU  is  to  regulate  the  APU-Clutch  or  the  CD-Clutch 
precisely  in  such  a  way  as  to  accelerate  the  corresponding  Gearbox  to  rated  RPM  at  the 
maximum  permissable  rate.  This  is  accomplished  by  employing  the  oi 1  temperature 
prevailing  at  that  moment  as  it  is  very  important  to  protect  the  delicate  IDG's  against 
exceeding  the  maximum  allowable  temperature-dependent  acceleration  envelope. 


F= Frequency  R  =  Resistonce  P=Pressure  V=Voltoge 


Fig.  3 

Clutch  regulating  Diagram 


The  Regulating  Circuit  Diagram  shown  above  is  identical  for  both  the  APU-Clutch  and  the 
CD-Clutch.  When  regulating  the  APU-Clutch  the  GBCU  processes  the  input  signals  RPM  and 
temperature  of  the  R/H  Gearbox  while  the  resulting  output  signal  operates  the  Servovalve 
thereby  regulating  the  clutch  operation.  When  regulating  the  CD-Clutch  the  GBCU  always 
processes  the  lower  RPM  Signal  and  the  lower  Oi 1  temperature  Signal  of  the  two  gearboxes. 
The  inductively  generated  RPM  Signal  is  differentiated  to  represent  the  Actual 
Acceleration  Value. 

The  temperature  value,  which  is  sensed  by  a  PTC-Resistor,  determines  the 
Acceleration  Set  Value  according  to  a  predetermined  Characteristic  Curve.  Subtraction  of 
the  Actual  Acceleration  Value  and  the  Set  Acceleration  Value  generates  an  erroi  signal 
which  is  processed  in  a  P I-Control 1 er .  The  resulting  output  signal  operates  the  Servo¬ 
valve  which  in  turn  operates  the  corresponding  clutch. 

In  order  to  improve  the  regulating  capability  a  Clutch  Hydraulic  Pressure  Signal  is 
fed  back  into  the  regulating  circuit. 

There  are  several  different  operating  modes  for  both  clutches.  The  APU-Clutch  and 
the  CD-Clutch  can  both  be  operated  in  the  Modes  "OPEN",  “CONTROLLED"  and  “FIX  CLOSED", 
while  the  CD-Clutch  can  be  additionally  operated  in  the  “OPEN  INTERLOCKED"  mode. 

Normally,  the  APU-Clutch  is  "open"  below  Rated  APU  RPM,  However,  as  soon  as  the  APU 
reaches  Rated  RPM  the  operating  mode  shifts  to  "controlled",  thereby  accelerating  the 
R/H  Gearbox  at  maximum  permissable  rate.  When  Gearbox  RPM  and  APU  RPM  are  equal  the 
clutch  enters  the  operating  mode  "fix  closed"  and  hence  provides  the  rigid  connection 
APU-R/H  Gearbox  while  the  APU  is  running. 

The  CD-Clutch  stays  "open"  as  long  as  the  pilot  leaves  the  CD-Switch  in  the  "open" 
posi tion. 

As  the  switch  is  placed  to  the  "CD-AUTO"  position,  the  clutch  automatically  shifts  to 
the  operating  mode  "controlled"  when  the  difference  in  RPM  of  both  Gearboxes  exceeds  a 
certain  value  and  when  at  least  one  of  the  two  Gearboxes  operates  at  a  certain  minimum 
RPM.  This  operating  mode  is  true  for  example  if  a  steady  state  Gearbox  is  automatically 
started  while  the  other  Gearbox  is  already  on  speed  or  if  a  Main  Engine  is  shut  down 
during  flight.  Thus,  the  regulated  operation  of  the  CD-Clutch  enables  the  automatic  RPM 
equalization  of  both  Gearboxes  within  permissable  limits. 

As  both  Gearbox  RPM's  are  equalized  the  CD-Clutch  automatically  shifts  to  the  operating 
mode  "fix  closed". 
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In  case,  however,  that  the  slower  running  Gearbox  does  not  reach  a  certain  minimum 
acceleration  value  within  2,5  secs  after  beginning  of  the  automatic  regulating  cycle 
the  operating  mode  "open  interlocked"  is  automatically  engaged.  Simultaneously,  the 
fault  signal  "OVERLOAD"  is  generated  in  the  GBCU,  which  results  in  the  Illumination  of 
the  corresponding  fault  light  and  triggers  the  MASTER  ALARM. 


3.  DESIGN  FEATURES 

3.1  MECHANICAL  CONSTRUCTION 

The  cast  Aluminum  Housing  of  the  SPSCU  is  attached  to  the  Airframe  via  four 
shockmounts . 


Fig.  4 

The  Secondary  Power  System  Control  Unit 


One  section  of  the  Housing  contains  the  9  Printed  Circuit  Boards  with  all  logic 
circuits  while  the  other  section  houses  a  plug-in  type  Chassis  which  carries  the  Power 
Supply,  the  Power  Relays  and  the  Interface  Circuit.  All  external  electrical  connectors 
and  all  control  elements  are  attached  to  the  Frontplate  of  the  Chassis. 

All  9  Printed  Circuit  Boards  as  well  as  the  Chassis  are  plug-in  type  Modules  which 
can  be  easily  replaced  -  without  the  need  for  special  tools  -  after  a  cover  has  been 
removed.  The  electrical  connection  between  the  Printed  Circuit  Boards  and  the  electrical 
components  attached  to  the  Chassis  is  accomplished  by  employing  a  Mul ti -Connector  Plate 
with  the  associated  interconnecting  wiring.  This  Plate,  which  is  easily  replaceable  due 
to  its  modular  construction,  is  mounted  in  the  lower  part  of  the  Housing. 

All  subassemblies  of  the  SPSCU  can  be  replaced  without  the  need  for  a  special  post 
adjustment  or  post  calibration. 

The  SPSCU  is  hooked-up  to  the  airplane  via  two  electrical  connectors  which  are  attached 
at  toe  Front  Plate  of  the  plug-in  type  Chassis. 


3.2  ELECTROMAGNETIC  COMPATIBILITY 

In  order  to  improve  the  EMC-Capabi 1 l ty  of  the  SPSCU  a  subdivision  into  a  Power- 
Connector  and  a  Si gnal -Connector  was  mandatory.  All  electric  wiring  which  is  closely 
associated  with  the  28  V  Power  System  of  the  aircraft  is  fed  into  the  Power-Connector, 
while  all  wiring  which  has  to  conduct  delicate  signals  and  which  is  therefore  shielded, 
is  fed  into  the  Signal -Connector. 
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The  strict  separation  of  the  Signal -Wi n ng  and  the  Power  Wiring  is  continued  inside 
the  SPSC'J.  In  the  vicinity  of  the  Power-Connector  a  special  i  amber  had  to  be  installed. 
This  Chamber  is  very  carefully  shielded  and  houses  the  Power  Relays  for  controlling 
several  external  devices.  All  electrical  connections  between  the  components  housed  in 
this  Chamber  and  all  other  components  in  the  SPSCU  are  consequently  run  via  EMC-Filters. 
Thus,  the  employment  of  the  technique  just  described  above  and  the  additional  careful 
bonding  of  all  components  provide  the  SPSCU  with  a  very  high  EMC-Capabi 1 i ty .  This  EMC- 
Capability,  which  is  required  according  to  PANAVIA  Specs..  90001  and  90003  has  been 
successfully  proved  during  previous  Qualification  Tests. 


3.3  TESTABILITY 

A  third  electrical  connector,  which  is  also  attached  to  the  Front  Plate  and  which  is 
normally  protected  by  a  cap,  is  used  for  test  purposes.  This  Test-Connector,  which  has 
128  pins,  enables  the  technican  to  perform  the  complete  Acceptance  Test  or  a  Fault 
Diagnosis  down  to  Module  Level  without  opening  the  SPSCU. 

Even  with  the  SPSCU  still  mounted  to  the  airframe  the  Secondary  Power  System  can  be 
tested  with  a  Special  Test  Set  via  the  Test-Connector,  and,  if  necessary,  a  Fault 
Diagnosis  may  also  be  accomplished.  In  addition  3  Push-Buttons  are  mounted  on  the  Front 
Plate.  The  Push-Buttons  operate  the  BITE-System,  which  is  divided  into  an  APU-Section, 
and  a  GB  Right  and  a  GB  Left  Section,  The  BITE-System  monitors  the  dormant  protection 
circuits  of  the  SPSCU.  The  results  of  the  BiTE-Tests  are  displayed  on  the  Front-Plate  by 
8  LED's.  Any  faults  occurring  during  the  operation  of  the  Secondary  Power  System  will 
also  be  displayed  by  these  LED's. 

In  addition,  the  OR-Connecti on  of  each  of  the  8  possible  Fault-Signals  triggers  the 
Master-Alarm  at  the  Maintenance  Panel.  However  during  BITE-iesting  the  Master  alarm  in 
the  SPSCU  is  suppressed. 


3.4  THE  ALGORITHMIC  STATE  MACHINE 

The  most  important  functional  task  for  the  APUCU  and  the  GBCU  is  to  digitally  control 
and  monitor  the  different  operating  modes  in  which  both  systems  are  engaged  at  that 
moment . 

For  example  the  APUCU  can  assume  the  Internal  States 

INITIAL  STATE  I 
INITIAL  STATE  II 
STARTING  I 
STARTING  II 
RUN  UP 

APU  RUNNING  and 
STOP 

Each  one  of  the  above  mentioned  Internal  States  is  processed  in  conjunction  with 
the  APU  RPM,  the  corresponding  Parameters  and  the  Internal  Time  Monitoring  Logic. 

Also  in  each  one  of  these  Internal  States  certain  characteristics  of  the  Input  Signals 
are  being  monitored  and  Special  Command  Signals  for  actuating  external  components  are 
generated  (for  example  the  commands  "Engage  Starter"  or  "Close  Master  Fuel  Valve"  etc.). 
The  change-over  from  one  State  to  the  next  can  only  take  place  at  exactly  defined  Time 
Schedule  with  the  corresponding  Input  Signals  assuming  exactly  defined  conditions. 

The  GBCU  controls  the  CD-Clutch  in  a  similar  manner.-  Here,  the  following,  already 
previously  mentioned  States  may  be  assumed: 

OPEN 

CONTROLLED 
FIX  CLOSED 
OPEN  INTERLOCKED 

The  circuit  arrangement  technique  employed  for  both,  the  APUCU  and  the  GBCU  is 
called  "Algorithmic  State  Machine". 
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Fig.  5 

The  Algorithmic  State  Machine 


This  means  that  all  Input  Signals  being  monitored  are  stored  with  a  repetition 
frequency  of  approximately  30  Hz  at  the  rising  slope  of  each  Clock  Pulse.  Thus,  the 
signals  gathered  in  conjuntion  with  a  feedback  operate  a  Programmable  Read  Only  Memory 
(PROM),  whereby  the  Address  Code  represents  the  System  State  valid  at  that  moment. 

The  multiude  of  all  possible  2n  Addresses  at  n  addressbits  resembles  the  r0tal  of 
all  operating  modes.  Due  to  the  specific  program  design  the  PROM  Output  Signals  deliver 
intelligent  data  for  all  possible  operating  modes,  i.e.  which  State  should  be  adopted 
next  and  which  decisions  should  be  made  with  regards  to  the  controlled  output  variables. 

With  the  falling  slope  of  the  Clock  Pulse  this  data  is  transferred  to  a  second 
memory  where  it  is  stored  for  further  usage. 

Due  to  this  special  design  of  the  Logic  the  circuitry  which  determines  the  response  of 
the  APUCU  and  the  GBCU  is  very  flexible  programmable  and  -  because  of  its  slowly  clocked 
function  -  very  resistant  against  undesired  noise. 

As  the  system  reponse  can  be  programmed  separately  for  each  operating  mode  it  is 
readily  possible  to  recognize  -  by  employing  the  proper  Software  -  any  unrealistic 
combination  of  Input  Signals  (for  instance  as  in  case  of  a  fault,  etc.). 

It  is  also  readily  possible  to  initiate  the  corresponding  countermeasures  and/or 
generate  the  proper  Fault  Signal.  Thus,  an  additional  opportunity  for  monitoring  the 
internal  unit  function  is  provided. 


3.5  POWER  CONSUMPTION 

During  the  SPSCU  design  state  the  attention  was  focused  on  low  powe-  cosumption.  The 
Application  of  the  CMOS-Techni que  was  therefore  adopted  whenever  possible.  The  PROM's 
however  operate  with  such  unfavourable  Power  Consumption  factors  that  the  benefit  of  the 
rest  of  the  circuitry  would  have  been  nullified.  So,  in  this  case,  a  special  circuit 
design  was  necessary  to  compensate  for  the  disadvantage  mentioned  above. 

This  was  accomplished  in  the  following  way: 

Due  to  the  Clocked  function  of  the  Sequential  Logic  a  PROM  Information  Signal  is 
generated  each  30  msecs,  however  the  actual  Signal  Read-Out  Time  is  much  shorter,  namely 
less  than  2  yjsec. 

Since  a  P\GM  does  not  lose  its  memory  during  a  power  shut  down  and  since  all  output 
data  is  immediately  stored  after  it  has  been  read,  it  is  possible  to  switch  off  the  power 
supply  to  the  PROM's  during  the  relati/ely  long  time  intervals  between  each  read-out. 

This  action  does  in  no  way  change  the  response  of  the  Logic,  but  the  Power  Consumption 
will  be  improved  by  the  factor  15  x  10^  compared  to  PROM's  being  continuously  under 
power.  Thus,  the  benefits  of  the  CMOS-Techmque  could  be  fully  enjoyed. 


3-8 


The  RPM  Monitoring  of  the  APU  and  the  Time  Monitoring  of  the  APUCU  and  the  GBCU  are 
also  accomplished  digitally.  In  this  case  presettable  Down-Counters  are  loaded  by  the 
PROM's. 

They  determine  all  Times  and  RPM's  with  quartz-based  accuracy.  The  advantage  of 
programming  very  flexible  and  of  reducing  the  Power  Consumption  by  switching  off  the 
Power  Supply  to  the  PROM's  between  each  Read-Out  interval  is  in  this  case  also 
successfully  utilized.  ^ 


4.  CONCLUSIONS 

Finally,  it  should  be  mentioned  that  the  SPSCU  can  be  easily  tested  and  maintained 
without  major  difficulties  thanks  to  the  special  e -'forts  taken  during  the  development 
pnase  to  the  unit. 

At  this  moment  the  following  items  are  in  the  design  stage  or  under  construction  or  have 
already  been  supplied  to  the  customer: 

A  tester  for  the  entire  Secondary  Power  System  for  field  use, 
a  Special  to  Type  Test  Equipment  for  the  SPSCU  and 

the  ATLAS  Software  for  Testing  and  Trouble  Shooting  with  Automatic  Test  Equipment.- 

Also  during  the  design  stage,  special  attention  was  paid  to  the  very  high  demands 
for  environmental  compatibility  like  Temperature,  Altitude,  Vibration,  Shock,  Acoustical 
Noise,  EMC,  Contamination,  etc.  This  was  verified  by  tre  relatively  unproblematic 
execution  of  the  Type  Approval  Tests. 


Since  January  1978  the  SPSCU  is  in  series  production  for  the  Weapon  System 
PANAVIA  TORNADO. 


DISCUSSION 


G.E. Davies,  UK 

How  much  power  in  watts  do  you  save  by  switching  the  PROM  power  supplies? 

Author’s  Reply 

Your  question  can  be  answered  in  two  steps 

(1 )  The  APU  and  Gearbox  sequencing  circuitry  contains  two  PROMs,  each  pulling  approximately  140  milliamperes 
from  the  28  Volt  supply  through  a  series  regulator.  Continuous  PROM  operation  would  result  in  approximately 
7.8  Watts  power  consumption.  With  the  duty-cycle  2  ps/30  ms  the  consumption  decreases  to  approximately 
0.5  Milliwatts! 

(2)  The  speed  and  time  measurement  circuitry  of  the  APU  Control  Unit  operates  two  PROM’s  which  would 
consume  another  7.8  Watts,  if  not  switched  off. 

During  APU  start-up  three  time  measurements  are  taken.  This  means  that  one  of  these  two  PROMs  is  switched 
on  for  a  total  of  approximately  6  Microseconds  and  then  stays  switched  off  for  the  remaining  time  of  system 
operation.  This  saves  additional  3.9  Watts. 

The  power  for  the  APU  speed  measurement  PROM  is  clocked  (under  worst-case-condition,  which  is  “APU  at 
maximum  speed”)  with  a  duty-cycle  of  2  ps/142ps.  This  results  in  an  actual  consumption  average  of  0.5  Watts 
and  a  saving  of  approximately  3.4  Watts. 

In  total  the  average  saving  in  power  consumption  for  the  whole  Control  Unit  due  to  clocked  power  for  the 
PROM’s  is  approximately  15  Watts. 
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CONCURRENT  DEVELOPMENT  AND  TEST  OF  A  DIGITAL  ELECTRONIC  CONTROLLER 
WITH  AN  ADVANCED  VARIABLE  CYCLE  ENGINE 


BY 

RICHARD  W.  CORDING 

SENIG  ,  ENGINEER  -  ELECTRONIC  CONTROLS  DEPARTMENT 

AND 

FRANK  J.  O'KEEFE 

PROJECT  ENGINEER  -  ELECTRONIC  CONTROLS  DEPARTMENT 

THE  BENDIX  CORPORATION 
ENERGY  CONTROLS  DIVISION 
717  N.  BENDIX  DRIVE 
SOUTH  BEND,  INDIANA  46620 


SUMMARY 

The  need  for  high  performance  propulsion  systems  with  wide  operating  envelopes  has  resulted  in  the  design  of  ad¬ 
vanced  technology  variable  cycle  engines.  The  sophistication  of  this  type  of  engine  design  has  resulted  in  increasingly 
complex  requirements  for  the  engine  control  system  as  well  as  for  engine  components.  Implementing  the  intricate 
control  schemes  for  an  advanced  technology  variable  cycle  engine  can  be  best  accomplished  using  a  full  authority 
digital  electronic  controller.  The  capabilities  of  the  digital  controller  allow  for  safe  and  stable  operation  of  the 
engine  while  optimizing  engine  performance  over  the  flight  envelope.  In  addition,  the  flexibility  of  the  digital  controller 
facilitates  engine  development  testing  by  accommodating  new  engine  component  characterizations  as  they  evolve  and 
by  implementing  special  test  functions  that  can  be  controlled  by  the  test  engineer. 

This  paper  describes  a  program  in  which  a  full  authority  digital  electronic  controller  is  used  as  a  tool  in  the  develop¬ 
ment  of  an  advanced  technology  variable  cycle  engine.  The  concurrent  development  of  an  engine  mounted  digital 
controller  and  an  advanced  technology  variable  cycle  engine  imposes  unique  problems  yet  provides  several  advantages. 
These  problems  and  advantages  will  be  highlighted  in  the  discussion  of  the  control  system  development. 

LIST  OF  SYMBOLS 


DDA 

— 

Detroit  Diesel  Allison 

JTDE 

— 

Joint  Technology  Demonstrator  Engine 

ATEGG 

— 

Advanced  Turbine  Engine  Gas  Generator 

EH-K1 

— 

Model  Designation  for  Bendix  Digital  Controller 

A/D 

— 

Analog  to  Digital  Converter 

D/A 

-- 

Digital  to  Analog  Converter 

RAM 

— 

Random  Access  Memory 

ROM 

— 

Read  Only  Memory 

VCE 

— 

Variable  Cycle  Engine 

CPU 

— 

Central  Processing  Unit 

CRT 

— 

Cathode  Ray  Tube 

PROM 

— 

Programmable  Read  Only  Memory 

EPROM 

— 

Erasable  Read  Only  Memory 

PLA 

— 

Power  Lever  Angle 

LVDT 

— 

Linear  Variable  Differential  Transformer 

INTRODUCTION 

Preliminary  design  studies  were  conducted  by  Detroit  Diesel  Allison  (DDA)  to  identify  specific  advanced  technologies 
that  would  satisfy  future  Navy  and  Air  Force  weapons  system  propulsion  requirements,  and  these  technologies  are 
being  incorporated  in  the  DDA  Joint  Technology  Demonstrator  Engine  (JTDE). 

The  JTDE  is  a  two-spool  Variable  Cycle  Engine  (VCE)  incorporating  the  following  technologies: 

—  High  performance,  distortion  tolerant  fan 

—  Variable  flow  capacity  compressor 

—  Staged  combustors  for  nigh  efficiency 

—  Variable  flow  capacity  high  pressure  turbine  vanes 

—  Variable  flow  capacity  jet  flap  low  pressure  turbine  vanes 
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—  Plug-type  primary  exhaust  nozzle 
—  Advanced  materials 

—  Complete  actuator/sensor/digital  control  system 

The  advanced  development  of  these  technologies  was  supported  through  the  DDA  Advanced  Turbine  Engine  Gas  Generator 
(ATEGG)  program  with  the  ATEGG  being  a  subset  of  the  JTDE. 

While  the  engine  hardware  was  developed  by  DDA,  the  development  of  the  digital  electronic  controller  was  the  primary 
responsibility  of  The  Bendix  Corporation,  Energy  Controls  Division.  The  specifications  for  an  engine  mounted  digital 
electronic  controller  for  the  JTDE  posed  numerous  hardware  and  software  design  challenges.  The  electronic  controller 
reir'ires  the  interface  hardware  and  software  to  control  two  compressor  geometry  loops,  two  fuel  loops,  two  turbine 
geometry  loops  and  two  exhaust  nozzle  loops.  Hardware  interfaces  had  to  be  designed  to  accurately  measure  engine 
temperatures,  pressures,  speeds,  and  actuator  positions  (resolvers,  LVDTs  and  potentiometers).  In  addition, 
system  safety  requires  that  special  attention  must  be  paid  to  the  reliability  of  the  components  used  in  the  system  to 
insure  the  proper  operation  of  the  controller  in  the  harsh  engine  environment  of  high  temperatures  and  high  vibration 
levels.  Other  system  constraints  are  that  the  engine  parameter  inputs  must  be  read  and  the  control  computation  com¬ 
pleted  at  a  high  enough  frequency  to  permit  stable  operation  of  the  high  response  control  loops,  and  extensive  parameter 
monitoring  and  health  checks  be  made  to  insure  fail-safe  shutdown  in  the  event  of  any  out-of-tolerance  condition. 

To  facilitate  the  concurrent  development  with  an  advanced  technology  variable  cycle  engine,  maintainability  was  a  key 
design  parameter  in  the  electronic  controller's  hardware  and  software.  The  controller  hardware  was  partitioned  into 
functional  modules  to  aid  in  quick  fault  isolation  and  module  replacement.  Similarly,  the  software  was  partitioned 
into  functional  modules  to  aid  in  software  verification  and  to  allow  for  rapid  accommodation  of  new  engine  component 
characterizations.  Another  consideration  was  to  include  provisions  for  enhancing  the  testability  of  the  system  software 
and  hardware  to  aid  in  debugging  problems  which  arise  during  the  software  verification  and  engine  testing. 

A  block  diagram  of  the  JTDE/electronic  controller  is  shown  in  Figure  1.  The  goals  of  the  controller  program  described 
in  this  paper  were  two-fold:  improved  engine  performance  through  the  use  of  the  electronic  controller  on  the  JTDE  and 
the  development  of  an  electronic  controller  system  that  will  be  ready  for  production  with  the  engine.  The  remainder 
of  the  paper  summarizes  the  program  developments  in  the  control  mode,  hardware  and  software  design  of  the  electronic 
controller. 

CONTROL  MODE  DEVELOPMENT 

The  development  of  an  electronic  controller  concurrently  with  an  advanced  technology  variable  cycle  engine  draws 
together  an  engine  design  program  and  control  feasibility  studies.  With  the  use  of  the  digital  controller,  the  engine 
designers  were  able  to  take  advantage  of  closed  loop  control  of  engine  geometries  and  accurate  steady-state  governing 
of  the  engine  which  was  previously  run  manually.  The  control  designers  gained  experience  in  applying  control  laws 
to  advanced,  working  hardware. 

Control  feasibility  work  proceeded  in  parallel  with  the  ATEGG  engine  development  and  test  program.  As  engine  test 
data  became  available,  it  was  incorporated  into  the  digital  simulation  models  at  ">DA.  These  mi  ^els  were  used  to 
solve  the  multiloop  control  problems  presented  by  a  variable  cycle  engine  with  the  resultant  loop  interactions.  DDA 
performed  trade  studies  to  determine  which  engine  parameter  could  be  most  effectively  controlled  by  each  control 
variable.  Trade  studies  were  also  made  to  achieve  a  balai..  a  between  the  engine  operational  requirements  and  safe 
operation  in  terms  of  steady-state  and  transient  margins  from  surge,  as  well  as  mechanical  and  thermal  limits.  From 
these  preliminary  studies  emerged  a  definition  of  the  control  laws  to  be  applied  to  the  engine.  Compromises  were  made 
in  the  control  mode  as  hardware  and  technological  constraints  were  defined  or  became  known.  All  minor  (actuator 
position)  loops  are  closed  through  the  digital  ,ontroller  in  addition  to  the  major  (engine  parameter)  loops.  These  minor 
loops  presented  some  unique  problems  in  that  some  devices  being  controlled  were  existing  laboratory  hardware  which  in 
some  cases  were  not  well  sized  for  digital  control  loops.  In  these  loops,  the  dynamics  of  the  digital  computer  become 
significant  and  limit  the  realizable  bandpass  of  the  servos. 

Once  the  minor  loops  had  been  sized,  it  was  then  possible  to  resize  the  gains  in  the  major  loops  for  the  given  control 
laws.  This  was  done  on  the  ATEGG  with  classical  techniques  and  linear  descrmtions  of  the  engine.  First,  the  fuel  flow 
loop  was  closed  and  designed  to  a  desired  set  of  stability  margins.  Then  the  geometry  loops  were  sized  to  specific 
stability  margins  considering  the  fuel  loop  as  e  closed  inner  loop.  When  the  loops  were  sized  and  their  linear  perfor¬ 
mance  known,  nonlinear  transients  were  again  simulated  at  DDA  and  performance  verified.  Figure  2  shows  a  block 
diagram  of  the  fuel  control  mode,  and  Figure  3  shows  a  typical  actuator  position  loop. 

In  order  to  verify  correct  operation  of  the  electronic  controller  prior  to  engine  tests,  a  real  time  nonlinear  engine 
model  was  programmed  on  the  Bendix  hybrid  computer  with  simulated  sensors  and  actuators  added  to  the  model. 

When  the  software  coding  was  finished  and  had  been  checked  in  an  open  loop,  the  controller  was  moved  to  the  hybrid 
computer  and  used  to  close  the  simulated  loops  as  shown  in  Figure  4.  The  closed  loop  system  is  then  tested  to  insure 
that  the  simulated  system  provides  the  expected  frequency  response  and  transient  res’ilts. 
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The  flexibility  of  the  digital  control  has  been  evident  in  a  demonstration  program  of  this  type.  As  the  ATEGG  has  gone 
through  succeeding  tests,  the  control  mode  has  evolved  from  the  original  concepts.  These  modifications  were  accom¬ 
plished  by  software  changes.  Prior  to  each  engine  test,  the  software  updates  are  incorporated  and  checked  in  a  closed 
loop  with  the  simulation  for  correct  operation. 

As  the  program  progressed  to  the  JTDE  phase,  a  similar  control  law  development  process  occurred.  Because  of  the 
complexity  of  the  JTDE,  the  loop  sizing  process  was  performed  by  means  of  extensive  nonlinear  digital  simulation 
work  at  DDA.  New  control  laws  were  then  programmed  in  the  electronic  control  by  Bendix,  and  nonlinear  hybrid 
simulation  of  this  system  was  also  programmed  on  the  hybrid  coirputer  and  used  for  software  verification. 

HARDWARE  DEVELOPMENT 


The  digital  electronic  controller  for  the  JTDE  was  designed  and  built  using  the  technology  available  in  1975.  A  16  bit 
Bendix  microprocessor  (BDX-920)  was  used  in  the  electronic  controller  to  implement  the  sophisticated  control  mode 
of  the  JTDE.  Adaptability  was  incorporated  into  the  unit  by  designing  the  controller  hardware  to  interface  with  the 
ATEGG  as  well  as  the  JTDE.  To  facilitate  software  changes  during  the  engine  development  cycle,  a  16000  word 
reprogrammable  core  memory  unit  external  to  the  controller  housing  was  used.  Provisions  were  included  in  the 
controller  housing  for  the  final  PROM/RAM  or  EPROM/RAM  memory  cards. 

One  of  the  main  tasks  of  the  electronic  controller  hardware  is  to  make  accurate  and  reliable  measurements  of  the  engine 
parameters  (temperature,  pressure,  position  and  speed)  at  a  sufficient  update  rate  for  stable  digital  control.  Accurate 
engine  temperature  measurements  are  made  by  the  controller  by  using  voltage  amplification  circuits  with  cold  junction 
compensation  on  thermocouple  inputs.  The  pressure  transducers  are  based  on  vibrating  quartz  crystals  with  on-board 
temperature  compensation.  Either  potentiometers,  LVDTs,  or  resolvers  are  used  for  position  feedback  measurements 
and  magnetic  pickups  are  used  to  supply  frequency  signals  to  the  speed  processing  circuits.  The  EH-K1  electronic  con¬ 
troller  hardware  incorporates  the  following  features: 

—  CONTROL  MODES  —  CAPABLE  OF  CONTROLLING  DDA  JTDE 
VARIABLE  CYCLE  ENGINE: 

10  Modulated  Torque  Motor  Drivers 

5  Solenoid/Relay  Drivers 

3  Fault  Indication  Flag  Drivers 

12  Resolver  Inputs 

6  Thermocouple  Inputs 

8  Pressure  Inputs 

4  Speed  Inputs 

16  Discrete  Inputs 

2  Serial  Digital  Input  Channels 

1  Serial  Digital  Output  Channel 

18  Analog  Input  Buffers 

3  Trim  Potentiometers 

—  LOW  POWER  SCHOTTKY  T2L  DIGITAL  LOGIC  FOR  CPU 

—  FAULT  ACCOMMODATION 

—  INTERNAL  POWER  REGULATORS  MODULES  AVAILABLE  FOR  ENGINE 
ALTERNATOR,  115  V  400  HZ  SINGLE  PHASE  OR  35  VDC  POWER  SOURCE 

In  addition  to  the  requirement  for  high  accuracy  in  the  engine  parameter  monitoring,  the  electronic  package  design 
must  maintain  the  electrical  components  within  allowable  temperature  and  vibration  levels  in  order  to  obtain  the  high 
reliability  required  of  the  electronic  controller.  The  electrical  components  are  mounted  on  copper  heat  rail  grids  that 
help  to  dissipate  the  heat  generated  by  the  components  with  additional  cooling  accomplished  by  circulating  engine  fuel 
through  the  outer  wa.ls  of  the  controller.  Special  care  was  given  to  the  mounting  of  the  pressure  transducer  subassem¬ 
blies  to  guard  against  exciting  the  ''Lbrating  element  at  its  resonance.  Additional  vibration  isolation  of  the  controller  is 
provided  through  the  use  of  shock  absorbing  engine  mounts  on  the  controller.  The  heat  rail  grids  also  provide  extra 
stiffness  to  the  circuit  modules  to  minimize  board  vibrations. 

Figure  5  shows  the  backplane  side  of  the  EH-K1  with  the  circuit  modules  removed.  Figure  6  shows  the  circuit  modules 
mounted  in  the  controller  and  Figure  7  shows  the  EH-K1  controller  mounted  on  the  ATEGG  for  testing. 

The  interfacing  of  the  electronic  controller  with  the  engine  occurs  in  three  phases.  Initially,  the  electronic  control  is 
connected  to  the  actuators  with  the  engine  shutdown  for  open  loop  te°ts.  Loop  stability  and  step  response  data  is  taken 
to  insure  safe  and  stable  actuator  control.  During  the  second  phase,  the  electronic  control  is  running  "piggyback"  on 
the  engine.  At  this  phase,  the  engir  Tinning  is  accomplished  from  a  manual  test  console.  The  electronic  control  is 
monitoring  "live"  engine  parameters,  but  the  actuator  commands  and  feedbacks  are  closed  through  an  analog  loop 
closure  box  which  simulates  the  engine  actuators.  The  third  phase  is  the  actual  control  of  the  engine  with  the  electronic 
controller.  Figure  1  is  also  indicative  of  the  engine  test  set  up. 


Many  advantages  accrue  in  hardware  deuifn  because  of  the  parallel  development  of  the  electronic  controller  and  the 
JTDE.  Obviously,  the  experience  gained  through  engine  testing  identifies  any  problems  in  accuracy  or  reliability 
resulting  in  improvemei  ts  that  can  be  incorporated  in  the  present  design  or  in  subsequent  projects.  This  applies  to 
both  the  electronic  controller  internal  hardware  and  the  electro-pneumatic  or  electro-hydraulic  engine  actuators. 

Other,  not  so  obvious,  advantages  are  afforded  to  the  engine  development  by  the  electronic  control.  Extra  margins  of 
safety  in  the  engine  operation  are  possible  with  the  electronic  control  because  of  the  extensive  parameter  monitoring 
capabilities  for  out-of-tolerance  inputs,  programmed  limiters  to  guard  against  exceeding  temperature,  pressure,  or 
rotational  limits  during  transients,  and  fail-safe  switchovers  from  the  electronic  control  to  a  backup  unit  of  a  critical 
failure  has  been  detected.  In  addition,  the  repeatability  of  data  is  enhanced  through  the  use  of  the  electronic  controller 
when  compared  with  manual  control.  Accurate  steady- state  governing  of  the  engine  can  be  maintained  while  the  effects 
of  excursions  of  individual  engine  actuators  are  investigated.  Precise,  repeatable  acceleration  and  deceleration  rates 
can  be  implemented  also. 

SOFTWARE  DEVELOPMENT 

The  software  implementation  of  the  control  mode  for  the  JTDE  and  ATEGG  was  written  in  the  Bendix  BDX-900  series 
assembly  language.  The  software  is  based  on  structured  programming  with  the  control  code  divided  into  functional 
modules  which  implement  selected  parts  of  the  entire  control.  In  addition,  numerous  macro  definitions  were  programmed 
for  repetitive  algebraic  and  logic  sequences  used  in  the  control  mode.  The  modular  implementation  of  ihe  control  code 
and  supporting  code  greatly  facilitated  the  initial  coding  effort,  the  debugging  effort  and  also  subsequent  control  code 
updating  of  the  software. 

The  software  in  conjunction  with  the  peripheral  hardware  and  interfaces,  perform  the  following  functions: 

—  Control  mode  computation  in  accordance  with  the  control  mode  specified. 

—  Input  and  output  processing  including  reasonableness  checks,  redundant  sensor 
switching,  and  parameter  synthesis. 

—  Diagnostic  checks  of  reference  voltages,  I/O  interfaces,  CPU  and  memory. 

—  Real  time  interactive  capabilities  including  operator  control  of  engine  geometry 
actuators  and  monitoring/modification  of  selected  control  variables. 

The  control  software  is  designed  to  run  In  a  real  time  environment  with  the  priority  requirement  being  the  control  of 
the  engine.  Two  interrupts  are  implemented  in  the  system  as  shown  in  Figure  8:  a  power-up  interrupt  and  an  interval 
timer  Interrupt.  The  control  software  structure  is  comprised  of  modules  falling  into  four  functional  areas: 

■  Executive  -  Interrupt  Level  Response 

—  Maintains  real  time  reference  of  control  solution  in  conjunction  with  the 
hardware  interval  timer 

—  Services  synchronous  functions:  A/D  inputs,  D/A  outputs 

—  Initializes  operation  in  response  to  power-up  interrupt  caused  by  system 
power-up  or  a  mode  select  switch 

•  Executive  Monitor 


—  Invokes  the  control  computation  at  the  beginning  of  each  20  millisecond 
solution  interval 

—  Schedules  execution  of  background  tasks  in  the  time  remaining  after  control 
computation 

•  Control  Tasks 


—  Processes  inputs 

—  Performs  computations  required  for  controlling  fuel  flows,  compressor 
geometries,  turbine  geometries  and  nozzle  areas 

—  Detects  faults  and  takes  appropriate  actions 

—  Computes  outputs  to  be  plotted  and  synthesis  parameters 

•  Background  Tasks 

—  Invokes  the  interactive  module  that  allows  real  time  monitoring  and 
modification  of  selected  input  or  outputs 

--  Invokes  software  diagnostics:  CPU  check,  memory  checksum,  and  RAM  check 


One  of  the  strengths  of  implementing  a  digital  electronic  control  is  the  ability  to  incorp  .rate  special  features  in  the 
software  to  aid  in  control  mode  verification  as  well  as  engine  development.  Also  included  are  provisions  for  rapidly 
incorporating  new  data  into  the  controller  software.  The  following  list  of  special  purpose  software  modules  is  included 
as  an  example  of  the  types  of  functions  implemented  in  the  electronic  control  software  to  enhance  the  e.igine/control 
system  development. 


MIACT 

Interactive  parameter  monitor  and  modifier  module.  Allows  RAM  value;,  for 
system  variables,  inputs,  outputs  and  intermediate  rates  to  be  monitored  and 
modified  from  the  CRT. 

MBOLD 

- 

Background  Bendix  On  Line  Debugger,  Allows  for  real  time  modification  of  any 
core  memory  location  from  the  CRT. 

MIHIS 

- 

Histogram  module.  Provides  for  statistical  da.  i  gathering  of  system 
variables. 

MXYPL 

- 

X  -Y  Plot  Ml  Qule..  Calculates  output  value  for  real  time  plotting  of 
system  variables. 

MRAMP 

- 

Ramp  module.  Allows  system  variables  to  be  ramped  up  or  down  with  a 
selectable  increment  until  the  desired  limit  is  reached. 

MSA 

- 

Sine  Wave  Addition  Module.  Provides  the  capabilit/  to  add  an  external  signal 
to  a  system  variable  for  frequency  response  testing. 

MXFER 

- 

Transfer  module.  Allows  the  electronic  control  to  assume  engine  control 
from  the  backup  unit  for  engine  start  up  or  at  engine  idle. 

MPLAC 

' 

PLA  cycle  module  for  cyclic  endurance.  Allows  for  a  prescribed  number  of 
engine  accel  and  decel  cycles  to  be  run  with  the  accel  rate,  time  at  max  speed, 
decel  rate,  and  time  at  min.  speed  adjustable  by  the  programmer/engineer/ 
test  operator. 

The  digital  capabilities  of  the  electronic  controller  also  allow  for  extensive  health  checks  of  the  control  system  to 
insure  safe  engine  operation.  Redundant  inputs,  as  well  as  rate  and  range  checks  on  all  engine  parameter  inputs  are 
used  to  insure  the  health  of  the  input  signals.  Critical  internal  hardware  circuits  of  the  electronic  controller  are 
monitored  by  the  software  to  insure  the  health  of  the  controller  hardware,  and  checks  of  the  RAM,  ROM  and  CPU 
are  performed  to  insure  the  health  of  the  CPU.  All  failure  flags  in  the  software  are  polled  in  the  control  software  to 
determine  the  health  of  the  system.  If  a  critical  failure  is  determined  to  have  occurred,  actions  are  Initiated  by  the 
controller  for  a  fail  safe  switchover  to  a  manual  backup  controller  to  protect  the  engine  from  possible  damage.  The 
number  of  health  checks  performed  as  well  as  the  speed  at  which  they  are  checked  provides  a  larger  margin  of  safety 
to  the  engine  than  afforded  by  a  manual  "panic"  button. 

CONCLUSIONS 

The  use  of  a  flight  worthy  digital  controller  early  in  the  development  cycle  of  a  Variable  Cycle  Engine  gives  benefits 
both  in  the  flexibility  of  the  engine  test  schedule  and  in  evolving  a  digital  controller  which  will  be  ready  for  production 
with  the  engine.  The  techniques  and  experiences  gained  in  the  concurrent  development  provides  a  maturing  of  the 
state-of-the-art  for  both  hardware  and  software  needed  for  th.'  high  performance  propulsion  control  systems  of  the 
80's. 

In  order  to  meet  the  increasingly  more  stringent  goals  of  the  development  of  a  VCE,  new  technologies  are  presently 
being  developed  at  Bendix.  A  lighter  flight  worthy  digital  controller  in  a  dual  configuration  implemented  with  a  single 
chip  16-bit  microprocessor  is  being  developed.  New  quartz  capacitive  pressure  transducer  modules  have  also  been 
designed  which  overcome  previous  transducer  problems.  New  technologies  are  also  being  developed  for  implementing 
modern  multivariable  control  laws  for  solving  the  engine  control  problem  and  for  incorporating  Low  Cycle  Fatigue 
calculations  in  the  electronic  controller. 

The  concurrent  development  of  the  digital  controller  and  the  Variable  Cycle  Engine  will  result  in  the  realization  of 
the  goals  for  an  advanced  propulsion  systems  of  improved  engine  performance,  stability,  hot  section  life  and  fuel 
economy.  It  will  also  result  in  an  increase  in  the  control  system  reliability  while  reducing  system  weight,  in. Mai 
cost  and  maintenance  cost. 
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FIGURE  1.  JTDE/EIECTRONIC  CONTROLLER  BLOCK  DIAGRAM 


FIGURE  2.  JTDE  FUEL  CONTROL  MODE 
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FIGURE  3.  TYPICAL  JTDE  ACTUATOR  LOOP 
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FIGURE  4.  CONTROL  SOFTWARE  VALIDATION  WITH  HYBRID  SIMULATION 
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DISCUSSION 


J.Dunham,  UK 

What  is  your  back-up  system? 


Author’s  Reply 

For  the  JTDE,  which  is  a  development  engine  being  tested,  the  backup  unit  is  simply  a  mechanical  handvalve  test 
fixture  to  bring  the  engine  back  to  idle  speed  if  a  switchover  from  the  electronic  controller  has  occurred.  This 
system  is  not  for  production  but  used  only  for  the  testing  program. 


B.J.Cocking,  UK 

Could  you  tell  me  how  many  sensors  would  be  interfaced  to  a  production  unit,  and  how  this  number  affects  the 
MTBF  of  the  unit. 

Author's  Reply 

The  electronic  controlli  r  was  designed  to  interface  both  the  ATEGG  and  JTDE  as  well  as  additional  growth  possib¬ 
ilities.  Thus  it  has  provisions  for  approximately  50-60  inputs.  The  new  projects  that  are  working  on  have  approx¬ 
imately  20  inputs  in  a  dual  redundant  mode  and  we  are  trying  to  achieve  8000  hrs  MTBF. 


J.Legg,  UK 

Are  quartz  sensors  still  requiring  individual  calibration  cards? 

Audior’s  Reply 

Yes.  In  the  pressure  transducer  system  used  for  this  program,  each  transducer  has  its  temperature  calibration  data 
programmed  into  its  own  piom  card.  If  you  Gunge  a  pressure  transducer  element,  you  must  also  change  the 
associated  calibration  prom. 


M.J.Joby,  UK 

(1 )  One  of  the  most  difficult  gas  turbine  paiameters  to  measure  is  pressure  Could  you  indicate  the  accuracies  of 
measurement  set  as  design  targets,  and  whether  you  achieved  these? 

(2)  Over  what  temperature  range  was  tins  achieved > 

Author’s  Reply 

( 1 )  As  1  indicated  in  the  paper,  the  pressure  measurement  is  made  by  using  a  vibrating  quartz  crystal  whose  period 
is  modulated  by  the  pressure  1  believe  the  design  target  accuracy  was  0.5U  of  point.  We  came  close  to  this 
target  by  being  between  8  to  .5 7c  of  point. 

(2)  The  module  is  bench  tested  from  50°C  to  100°C  and  retains  this  accuracy.  For  engine  testing  of  the  JTDE, 
the  environment  lias  not  approached  these  temperature  extremes.  One  thing  that  we  have  tried  to  look  at  is 
the  long  term  drift  of  this  type  of  transducer  over  time  and  we  are  developing  a  quartz  capacative  transducer 
that  will  not  be  subject  to  this  long  term  drift. 


D.Schmidt,  Gt 

You  mentioned  in  your  conclusions  that  you  are  developing  new  technologies  for  the  introduction  of  modem 
multivariable  control  theories  to  solve  the  engine  s  control  problems.  Of  course  tins  question  if  of  theoretical  and 
academic  interest  But  which  practical  improvements  do  you  expect  trom  fins  development? 

Author's  Reply 

We  are  just  beginning  to  look  at  the  use  of  modern  multi-variable  contiol  theory  and  at  this  point  I  don’t  have  any 
practical  experience  that  would  indicate  the  advantages  that  may  occur 


S.R.Tyler,  UK 

Could  the  authors  please  give  information  on  positional  accuracy  ol  the  nozzle  position  transducers  and  the 
temperature  at  which  they  are  required  to  operate. 

Author's  Repiy 

I  he  nozzle  position  transducers  are  simply  high  temperature  potentiometers  Since  these  potentiometers  vveie 
.*  sting  hatdvvare  at  Detroit  Diesel  Allison,  and  specified  by  them.  1  do  not  have  the  figures  for  the  temperature 
range  that  they  are  designed  for 
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NOUVEAU  SYSTEME  DE  COMMANDE  DE  DEBIT  DE  CARBURANT  POUR  PETITES  TURBOMACHINES 


F.  ARNAUD  -  J.  GONZALES  -  B.  SECHER 
SociAtA  MICROTURBO  -  Boite  Postale  2089  -  31019  TOULOUSE  -  FRANCE 


RESUME 

Les  petites  turbomachines  utilisAes  comme  systAmes  de  dAmarrage  ou  groupes  autonomes  de  puissance  nAcessitent 
des  dispositifs  spAcifiques  de  commande  de  dAbit  carburant.  Apres  avoir  rappelA  les  contraintes  qui  lejr  sont 
propres  et  les  diffArentes  solutions  possibles,,  on  donne  le  pnncipe  et  le  fonctionnement  d'un  systAme  origi¬ 
nal.  Celui-ci  est  constituA  d'une  Alectropompe,  dont  on  fait  varier  la  vitesse  par  un  dispositif  Alectronique 
et  d'un  rAgulateur  simplifiA  de  pression  diff Arentielle.  Les  principaux  problAmes  rencontrAs  au  cours  de  la 
mise  au  point  de  deux  applications  particuliAres  sont  dAcrits  ensuite. 


1.  PRESENTATION 

Le  systAme  de  contrAle  de  carburant  qui  va  vous  Atre  prAsentA  a  AtA  dAveloppA  par  la  SociAtA  MICROTURBO 
pour  rAsoudre  les  problAmes  spAcifiques  de  ses  petites  turbomachines.  Celles-ci  n  it  des  puissances  thermiques 
sur  arbre  de  l'ordre  de  900  kW  et  sont  utilisAes  en  tant  que  : 

-  sy st Ames  de  dAmarrage. 

-  groupes  autonomes  de  puissance  (G.A.P. ) 

-  rAacteurs 

Nous  ne  parleronc  pas  ici  des  rAacteurs,  car  ceux  produits  par  MICROTLRBO,  AtanL  du  type  simple  corps, 
simple  flux  et  tuyAre  fixe,  ne  prAsentent  pas  de  difficultAs  particuliAres  pour  leur  rAgulation.  Ce  systAme 
a  fait  l'objet  d'un  brevet.  Avant  de  dAcrire  le  pnncipe,  le  fonctionnement  et  les  problAmes  particuliers 
rencontrAs  au  cours  de  la  mise  au  point,  nous  vous  prAsenterons  bnAvemenL  :• 

-  les  particularitAs  des  petites  turbomachines 

-  les  principaux  systAmes  de  contrAle  de  carburant  utilisables 

-  les  motifs  qui  nous  ont  conduit  au  dAveloppement  du  nouveau  systAme 


2.  PART1CULARITES  DES  PETITES  TURBOMACHINES 

Pour  fournir  une  puissance  de  quelques  centaines  de  kilowa.ts,  ll  suffit  d'un  dAbit  d'air  de  quelques 
kilo/seconde  et  de  vitesses  de  rotation  de  l'ordre  de  50  000  tr/mn.  Le  faible  dAbit  et  la  grande  vitesse 
conduisent  A  des  compresseurs  et  turbines  de  faible  diamAtre  (quelques  centimAtres) ,  et  par  consAquent,  A 
des  inerties  mAcaniques  trAs  petites.  Ces  machines  ont  done  des  temps  de  rAponse  trAs  courts  et  des  taux 
d'accAlAration  extrSmement  importants.  II  n'est  pas  rare,,  en  fonctionnement  normal,,  d'accepter  des  accAlA- 
rations  de  l'ordre  de  10  000  A  20  000  tr/mn/s,  et  on  comprend  alors  la  nAcessitA  d'une  rAgulation  trAs  ra- 
pide  et  prAcise. 

Pour  1 'avionneur ,.  un  systAme  de  dAmarrage  ou  un  G.A.P.  sont  des  Aquipements  presque  mineurs,  et  il  faut 
done  lAduire  au  maximum  leur  masse,  leur  encombrement  et  leur  cout.  Le  nombre  des  ionctions  de  contrAle  et 
de  sAcuritA  n'est  pas  proportionnel  A  la  taille  de  la  turbomachine  et  est  pratiquement  le  mSme  pour  une 
"petite"  ou  une  "grosse"  turbomachine.  Plus  la  turbomachine  devient  petite,  plus  la  part  relative  de  ses 
propres  "Aquipements",.  en  ce  qui  concerns  la  masse,  1 'encombrement  et  le  pm,  devient  iraportante.  On  est 
done  conduit  A  rechercher  un  systAme  de  contrAle  comportant  un  nombre  minimal  d'AlAmenls  simples,  fiables 
et  performants.  Pour  fixer  les  idAes,  nous  allons  vous  indiquer  les  paramAtres  principaux  de  deux  groupes 
typiques. 

Tout  d'abord,  un  systAme  de  dAmarrage  qui  fournit,  sur  son  arbre  de  sortie,  une  puissance  mAcanique  de 
150  CV  A  6  600  tr/mn  entre  -  45°C  et  +  45°C.  La  puissance  massique  de  sortie  est  de  l'ordre  de  5  CV/kg,  la 
puissance  thermique  interne  Atant  de  l'ordre  de  250  kW.  Ce  groupe  a  une  puissance  de  sortie  3  fois  plus 
grande,  A  masse  Agale,  qu'un  groupe  similaire  dAveloppA  il  y  a  une  quinzaine  d'annAes.  II  doit  Atre  capable 
de  passer  de  la  vitesse  nulle  A  sa  vitesse  nominale  en  quelques  secondes. 

Le  second  exemple  est  celui  d'un  G.A.P.  qui  fonctionne  entre  -  40°C  et  ISA  +  30°C,  jusqu'A  une  altitude 

de  9  000  m,  en  fournissant  une  puissance  mAcanique  de  200  CV  et  un  dAbit  d'air  de  prAlAvement  de  0,5  kg/s. 

Il  a  une  puissance  thermique  interne  de  l'ordre  de  450  kW  pour  une  masse  totale  du  caisson  de  80  kg. 

Il  est  bien  Avident  que  les  spAcif ications  de  ces  deux  systAmes  different  du  fait  de  leur  utilisation 
Pour  le  systAme  de  dAmarrage,  par  exemple,.  on  ne  considAre  pas  comme  prApondArante  sc  consommation  spAcifi- 
que  puisqu'il  ne  fonctionne  que  quelques  dizaines  de  secondes.  Sa  vitesse  de  rotation  n'a  pas  besom  d'etre 
rAgulAe  avec  une  grande  prAcision,  mais  par  contre,  on  lui  demande  de  dAmarrer  surement  quelles  que  soient 
les  conditions  de  tempArature,  et  d'amener  le  plus  vite  possible  le  rAacteur  A  son  rAgime  de  ralenti  Comme 
il  ne  sert  que  peu  de  temps,  sa  masse  et  son  encombrement  doivent  Atre  rAduits  au  strict  nAcessaire.  Le 
G.A.P.,  quant  A  lui,  devra  avoir  une  consommation  spAcifique  rAduite,  Atre  capable  de  fonctionner  dans  une 
large  enveloppe  et,  comme  il  entraine  le  plus  souvent  des  alternateurs ,  avoir  une  rAgulation  de  vitesse  prA¬ 
cise. 

Quel  que  soit  le  type  de  petite  turbomachine,  le  systeme  de  rAgulation  de  carburant  qui  la  ccmmande  doit 
assurer  le  contrAle  des  trois  phases  principales  de  fonctionnement  : 

-  l'allumage 

-  1 'accAlAration 

-  le  rAgime  nominal 
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Sur  la  figure  1,  ci-contre,  on  a  representd,  en  traits 
pleins,  la  quantity  de  carburant  &  injecter,  en  rdglme 
dtabli ,  en  fonction  de  la  vitesse. 

Bien  entendu,  dans  la  rdalitd,  11  n'y  a  pas  une  courbe 
unique,  raais  un  faisceau  de  courbes,  car  la  consomma- 
tion  varie,  pour  un  m6me  regime  de  rotation,  entre  au- 
tres,  en  fonction  de  la  temperature  de  l'air  ambiant 
et  en  fonction  de  la  charge  de  la  machine. 

La  courbe  en  trait  pointilld  reprdsente  la  quantity  de 
carburant  qu'il  faut  injecter  pour  accdldrer.  Le  pre¬ 
mier  point  critique  est  la  determination  de  la  tone 
d'allumage.  II  faut  en  effet  rdaliser  celui-ci  le  plus 
vite  possible  pour  deux  raisons  :• 

-  si  on  allume  a  vitesse  dlevde  la  flamme  a  tendance 
b  Stre  "souffiee"  a  l'exterieur 

-  si  on  allume  tardivement,  tout  le  carburant  qui  a 
ete  injecte  depuis  le  debut  de  la  sequence  s'enflamme 
brutalement  et  on  obtient  en  general  une  sortie  de  la 
flamme  et  une  extinction 

On  est  done  conduit  a  avoir,  au  point  d'allumage  un  de¬ 
bit  faible.  Or  la  technologie  des  injecteurs  est  telle 
que  pour  les  faibles  debits,  1 'angle  de  pulverisation 
n'est  convenable  que  si  : 

-  le  debit  d' entree  est  grand  dans  le  cas  d' injec¬ 
teurs  a  prdldvement 

-  la  pression  est  grande  dans  le  cas  d' injecteurs 
directs 

Le  deuxibme  point  deiicat  est  la  determination  de  la 
"marge"  d'accdldration,  e'est-a-dire  de  la  quantite 
suppldmentaire,  par  rapport  au  regime  etabli,  qu'il 
faut  injecter  pour  acceierer.  Si  elle  est  trop  faible 
la  machine  ne  diverge  pas  ou  le  ddmarrage  est  trop  long 
et  si  elle  est  trop  forte,  on  peut  avoir  soit  une  ex¬ 
tinction  par  exeds  de  richesse,  soit  mSSme  un  po.ipage 
si  1 'acceleration  du  mobile  est  trop  grande. 


3.  FRINCIFAUX  TYPES  DE  SYS  i'EMES  DE  CARBURANT 

Pour  definir  les  diffdrents  systdmes  utilisables  pour  les  petites  turbemaduncs,  il  faut  examiner  d'abord 
les  elements  constitutifs. 


3.1.  Elements  constitutifs 


Un  circuit  de  carburant  quelconque  comprend  essentiellement  les  organes  suivants  : 

-  "n  organe  gdndrateur  de  debit  de  carburant 

-  m  ou  plusieurs  organes  de  rdglage 

-  un  organe  rdeepteur  :  la  rampe  d' injection 


3.1.1.  Organes  gdndrateurs 

II  s'agit  des  pompes  A  carburint  qui  peuvent  dtre  : 

-  soit  entraindes  mdcaniquement  par  la  turbomachine 

-  soit  entraindes  par  un  moteur 

Le  premier  type  ndeessite  un  rddueteur  de  vitesse  entre  la  turbomachine  et  la  pompe  et  pre¬ 
sente  un  inconvenient  du  A  son  principe,  En  effet,  pour  pouvoir  allumer  la  machine  it  l'accdldrer,  on  a  be¬ 

som  d'un  ddbit  important  A  basse  vitesse,.  ce  qui  conduit  A  un  debit  surabondant  au  rdgime  nominal.  II  faut 
done,,  en  ce  point,  by-passer  la  majorite  du  ddbit  fourm. 

Les  pompes  entraindes  par  un  moteur  dlectrique  peuvent  presenter  aussi  certains  mconvdnienl s 
surtout  dans  le  cas  d'un  systdme  de  ddmarrage.  Leur  ddbit  depend  en  effet  de  la  tension  dispomble  A  la  bat- 
terie  pendant  le  ddmarrage  et  celui-ci  peut  varier  dans  de  tres  grandes  limites,  et  ceci  d'autant  plus  que 

la  temperature  modifie  les  caractdnstiques  de  la  batterie  et  la  viscositd  du  carburant. 


3.1.2.  Organes  de  rdglage 

On  peut  distinguer  :■ 

-  les  rdgulateurs  mdcaniques  dont  1'exemple  eypique  simple  est  le  regulateur  centrifugt 

-  les  rdgulateurs  pneumatiques 

-  les  rdgulateurs  "dlectro-nydrauliques"  tels  que  les  servovalves 

On  salt  que  les  rdgulateurs  mdcaniques  et  hydromdcaiuques  ont  616  utilisds  pendant  de  nom- 
breuses  anndes.  Leur  principe  est,  en  gdndral  simple,  mais  leur  rdalisation  et  leur  rdglage  sont  souvent 
dblicats,  ce  qui  conduit  A  un  prix  de  revient  souvent  prohibitif. 
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Les  servovalves  ont  fait  l'objet,  pendant  de  nombreuses  anndes,  d'une  suspicion  due  A  leur  fragility,  Elies 
sont  mamtenant  parfaitement  au  point,  mais  leur  technologie  conduit  A  des  usinages  trAs  ddlicats,  done  k 
des  prix  trop  dlevds  et  sont  aussi,  de  ce  fait,  sensibles  k  la  pollution  du  carburanc. 


3.1.3.  Organes  rdeepteurs 


En  ce  qui  concerne  les  petites  turbomachines,  on  n'utilise  que  deux  types  d'injecteurs  : 

-  les  injecteurs  directs 

-  les  injecteurs  "A  prdlevement"  ou  "A  retour" 

Les  premiers  ont  l'avantage  d'Stre  extrdmement  simples  et  done  fiables  et  peu  couteux.  Nous 
avons  d'ailleurs  utilisd,-  dans  une  application  particulidre,  de  simples  injecteurs  directs  employes  norma- 
lement  dans  les  bruleurs  de  chaudidre  de  chauffage  central 

Malheureusement,.  ce  type  d'injecteur  n'a  de  bonnes  qualitds  de  pulvdrisation  que  si  le  rap¬ 
port  entre  le  ddbit  maximal  et  le  ddbit  minimal  A  injecter  est  de  l'ordre  de  : 


Q  min 
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Les  injecteurs  a  prdldvement  sont  done  ndeessaires  dans  la  majority  des  cas.  La  Socidtd 
MICROTURBO  a  fait  un  important  effort  d'industrialisation  pour  produire,  &  des  prix  compdtitifs,  des  in¬ 
jecteurs  de  ce  type,  ayant  d ' excellentes  caractdristiques  de  pulvdrisation  afin  de  pouvoir  les  utiliser 
dans  la  majority  des  systdmes  produits  actuellement. 


3.2.  Architecture  de  quelques  systdmes 

Nous  allons  prdsenter  bridveraent  trois  systemes  qui  ont  dtd  utilisds  par  MICROTURBO. 


3.2.1.  Svstdme  "pneumatique" 

11  comprend,  d'amont  en  aval,  ainsi  qu'mdiqud  en  planche  1  : 

-  une  dlectropompe  dont  la  vitesse  est  rdgulde  A  +  5  'L  par  un  contacteur  centrifuge  incorpord 

au  moteur 

-  un  dlectrodistributeur  dont  1 'alimentation  dlectrioue  est  commandde  par  une  capsule  placde 
dar.s  le  bloc  rdgulateur  et  permet  de  n' injecter  du  carburant  que  lorsque  une  certaine  pression  rdgne  dans  la 
chambre  de  combustion 

-  un  K1oc  de  rdgulation  dont  la  disposition  est  telle  que  le  ddbit  de  carburant  est  asservi  k 
la  pression  P2  rdgnant  dans  la  chambre  de  combustion 

-  une  rampe  d'injecteurs  directs  spdciaux.  II  s'agit  en  effet  d'injecteurs  comportant  un  cla- 
pet  tard.  Les  rdg.lages  des  ciapets  des  huit  injecteurs  sont  ddcalds  les  uns  par  rapport  aux  autres  de  ma- 
nidre  A  ce  que,  au  fur  et  A  mesure  que  la  pression  fournie  par  la  pompe  augmente  un  nombre  grandissant  d'in¬ 
jecteurs  se  mettent  A  pulvdriser.  Le  ptincipe  de  ce  systeme  est  trds  simple.  II  faut  noter  cependant  que  le 
ddbit  dtant  asservi  A  la  pression  P2  rdgnant  dans  la  chambre  et  que  celle-ci  varie  avec  la  tempdrature  et 
l'altitude,  on  n'obtiant  pas  une  vitesse  de  consigne  fixe  ce  qui,.  dans  1 'application  ddcrite  ici  et  qui  con¬ 
cerne  un  systdme  de  ddmarrage,  n'a  pas  une  importance  primordiale.  Les  probldmes  rencontrds  sont  d'ordre 
technologique  :■  tout  d'abord  au  niveau  des  injecteurs  dont  lc  fabrication  et  le  rdglage  sont  ddlicats,  en- 
suite  au  niveau  de  la  rdgulation  centrifuge  du  moteur  de  la  pompe  dont  les  < araetdristiques  dvoluent  dans  le 
temps. 


3.2.2.  Systemes  dlectrohydrauliques 

Deux  variantes  ont  dtd  successivement  employdes,  toutes  deux  utilisant  des  injecteurs  A  prdle- 
vement, 

3. 2. 2.1.  Systdme  A  dlectropompe 

Ainsi  que  le  raontre  la  planche  2,  ce  systeme  comprend  : 

-  une  dlectropompe  A  vitesse  non  rdgulde  et  comportant  un  rdgulateur  de  pression  dont 
li  fonctionnement  est  associd  A  un  rdgulateur  de  ddbit 

-  un  rdgulateur  de  ddbit  qui  ne  peut  fonctionner  seul  car  il  ne  peut  pas  by-passer 
de  ddbit.  Pour  mamtenir  le  ddbit  dans  la  fourchette  de  rdglage  (de  1A5  A  155  1/h)  il  modifie  la  pression 
rdgnant  A  son  entrde  et  celle-ci,  en  se  rdpercutant  sur  le  rdgulateur  de  pression  montd  en  amont,  permet  A 
ce  dernier  de  by  passer  le  ddbit  exeddentaire 

-  une  servovalve  .  Celle-ci  est  placde  en  sdrie  dans  le  circuit  de  prdldvement  des 
injecteurs.  Commandde  par  un  boitier  dlectronique,  elle  "ouvre"  ou  "ferme"  plus  ou  moins  le  circuit  de  re¬ 
tour  au  reservoir.  Son  circuit  pilote  hydraulique  est  pris  directement  sur  le  circuit  normal  dtant  donnd  q"e 
les  diffdrences  de  pression  entre  l'entrde  et  la  sortie  sont  faibles. 

-  une  rampe  d'injecteurs  A  prdlevement 

Ce  systeme  a  rdvtld  A  l'usage  un  excellent  corap or tement  et  a  mdrae  permis,  par  de  simples  rdglages,  d'Stre 
adaptd  A  un  systeme  de  ddmarrage  qui  devait  §tre  capable  de  fonctionner  en  altitude.  11  comporte  malheureu¬ 
sement  beaucoup  d'dldments  et  certains  sont  fort  couteux  comme,  par  exemple,  la  servovalve. 


3. 2. 2. 2.  Systeme  A  pompe  entralnde 

Celui-ci,  ddcrit  A  la  planche  3,  comprenait  : 

-  une  pompe  entralnde,  A  travers  un  rdducteur,  par  la  machine.  Pour  permettre  le  dd¬ 
marrage  ,  cette  pompe  iourmssait.  au  rdgirae  nominal,  un  ddbit  dnorme  de  l'ordre  de  900  1/h,  sous  une  pres- 
sion  de  16  bars. 
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-  un  bloc  hydraulique  constitub  lui-mSme  de  d“u>  elements  : 

*  une  servovalve  placde  comme  prbcbdemment  dans  le  circuit  de  prblbvement 

*  un  clapet  differentiel  ;  celui-ci  btant  rendu  nbcessaire  par  le  fait  qu'il 
n'existe  pas,  sur  le  marchb  franqais,  de  petites  servovalves  capables  de  fonctionner  sous  une  difference  de 
pression  de  16  bars. 

-  une  rampe  d'injecteurs  a  prblbvement.  Ce  systbme  btait  compact,  mais  prbsentsit 
encore  des  inconvdnients  dus  b  la  servovalve.  Celles-ci,  en  effet,  ont  un  debit  de  fuite  non  nul  qui  peut 
conduire,  dans  certaines  conditions  climatiques,  4  des  dbmarrages  avortes  par  extinction  pauvre.  De  plus, 
le  problbme  du  prix  de  revient  de  cet  element  restait  pose. 


4.  MOTIFS  DU  CHOIX  DU  NOUVEAU  SYSTEME 

L'expbrience  acquise  en  exploitation  par  les  systbmes  ddcrits  ci-dessus  avait  permis  de  definir  surement 
deux  des  elements  constitutifs,  S  savoir  : 

-  les  injecteurs  a  retour 

-  1 'electropompe 

L'organe  rdgulateur  ne  pouvait  Stre  :  ni  une  servovalve,  car  cet  element  est  cher  et  sensible  a  la  pol¬ 
lution,  ni  un  regulateur  pneumatique,.  qui  ne  permet  pas  de  contrdler  avec  precision  la  vitesse  de  la  machine. 

C'est  alors  qu'est  nde  l'idde  de  repartir  la  fonction  de  contrdle  entre  deux  elements  : 

-  1 'electropompe  qui,-  btant  un  element  eiectrique,  peut  btre  comaandbe  par  une  electronique  de  regulation 

-  un  clapet  dif  fdrentiel ,-  qui  va  jouer  le  rdle  d'un  amplif icateur  hydraulique.  Ce  dernier  element  peut  ne 
pas  paraltre  nbcessaire  puisque  en  faisant  varier  la  tension  aux  bornes  de  1 ' electropompe,  on  fait  varier  le 
debit.  Mais  les  caractdristiques  des  injecteurs  a  prblbvement  sont  telles  que  pour  obtenir  une  variation 
substancielle  du  debit  injecte,  il  faut  faire  varier  de  manibre  importante  la  permeabilite  du  circuit  de  prb- 
lbvement.  Ce  qui  revient  a  dire  que  le  gainAQE/AQI  est  faible,  QE  etant  le  debit  d'entree  de  la  rampe,  et 

QI  le  debit  injecte.  On  pourrait  s'en  contenter,  mais  cela  conduirait,  pour  rbaliser  les  variations  de  de¬ 
bit  injecte  de  l'ordre  de  6a  10,  que  l'on  rencontre  comsnundment,  a  demander  a  la  pompe  des  variations  de 
debit  de  l'ordre  de  20  a  50  ce  qui  conduirait  a  une  electropompe  trop  encombrante  et  trop  lourde. 

Il  faut  noter  que  dans  le  cas  ou  l'on  peut  utiliser  des  injecteurs  directs,  on  peut  alors  se  passer  du 
clapet  differential,-  et  on  est  conduit  a  un  systbme  particulibrement  simple  puisque  ne  comprenant  qu'une 
electropompe  commandde  en  tension  et  une  rampe  d'injecteurs. 


5.  PRINCIPE  ET  FONCTIONNEMENT  DU  NOUVEAU  SYSTEME 
Le  systbme  comporte  done  : 

-  une  partie  eiectrique  comprenant  une  electropompe  a  vitesse  variable  commandde  par  un  boitier  electro¬ 
nique 

-  une  partie  hydraulique  comprenant  : 

*  un  clapet  differential 

*  une  rampe  d'injecteurs  a  preibvement 


5.1.  Partie  hydraulique 


Le  clapet  differential  proprement  dit  est  constitub  comme  indiqub  sur  la  planche  4,  On  voit  qu'il 
est  rbalisb  trbs  simplement  et  "ouvre"  ou  "ferme"  le  circuit  de  retour  en  fonction  de  la  difference  de  pres¬ 
sion  a  ses  "bornes".  Il  est  branchb  en  parallble  sur  la  rampe  d' injection  et  est  done  soumis  a  la  difference 
de  pression  Pce  -  PcR-  Tant  que  cette  difference  de  pression  est  lnfbrieure  a  1 'effort  du  ressort,  le  cir¬ 
cuit  retour  est  ouvert  et  prbsente  une  permbabilitb  maximale.  Lorsque  le  ddo,  :  d'entrbe  augmente  la  perte 
de  charge  de  la  rampe  d'injection  augmente.  Au  moment  ou  cette  perte  de  charge  devient  bgale  a  1 'effort  du 
ressort,  le  clapet  differentiel  commence  a  agir  en  fermant  le  circuit  de  retour. 


Il  faut  remarquer  ici  la  technologie  de  l'organe  de  reglage  qui 
est  constitub  par  un  poiriteau  pdndtrant  dans  un  siege  cylmdn- 
que.  En  effet,  si  l'on  trace  la  courbe  de  la  section  efficace  de 
passage  en  fonction  de  la  distance  entre  les  deux  organes,  on  ob- 
tient  un-.  courbe  de  la  forme  indiqube  ci-contre,  qui  montre  que 
le  gain  du  systbme  n'est  pas  lindaire. 

On  peut  tracer  en  laboratoire  les  caractdristiques  de  la  rampe 
d'injection  et  du  clapet  differentiel,  mais  ces  courbes  sont 
d'un  eraploi  peu  pratique, 

11  vaut  mieux  tracer  les  caractdristiques  completes  de  1 'ensemble 
sous  la  forme  d'une  courbe  Qi  =  f  (Qe)  qui  est  beaucoup  plus  par- 
lante. 


On  crouvera  S  la  planche  5  une  telle  courbe  et  l'on  remarque  lm- 
mddiatement  la  non  l.’iidaritd  du  systbme  : 

-  pour  les  faibles  Qe,  le  gain  est  faible 

-  pour  les  forts  Qe,  le  gain  est  grand 

Contrairement  A  ce  qu'on  pourrait  penser,  cet  aspect  est  favo¬ 
rable. 
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En  effet,  on  a  un  gam  minimum  pour  les  QE  et  QI  minimaux,  c'est-3-dire  pendant  la  phase  ddlicate  de  l'allu- 
mage  et  de  1  'acceleration,,  et  l'on  dispose  des  gains  maximaux  pour  les  forts  ddbits,  c'est-3-dire  aux  alen- 
tours  de  la  vitesse  nominale,  13  ou,  justement,  il  faut  assurer  le  meilleur  contrble  de  la  vitet.se. 

II  faut  noter  que  la  partie  quasi  horizontale  de  la  courbe  ddpend  essentiellement  du  circuit  de  retour.  Ceci 
revient  3  dire  que  si  les  pertes  de  charge  dues  aux  tuyaux,.  raccords,  clapets.  .  .  etc,  sont  sensibles,  ou 
bien  si  le  circuit  de  retour  est  pressurisd,  on  translate  la  courbe  vers  le  haut  et  on  arrive  ainsi  3  avoir 
des  ddbits  trop  grands  pour  assurer  un  allumage  correct. 

Comparons  maintenanl  les  courbes  Ql  =  f  (QE)  obtenues  pour  divers  rdglages  du  clapet  diffdrentiel  3  la  courbe 
de  consommation  N  =  £  (QI),  on  remarque  que  ces  courbes  ont  une  allure  gdndrale  similaire.  (planche  5) 

La  difference  entre  les  deux  rdglages  provient  d'une  difference  entre  les  valeurs  des  differences  de  pres- 
sion  auxquelles  le  clapet  entre  en  action.  On  remarque  que  dans  la  partie  de  variation  de  courbure,  celle-ci 
est  plus  faible  pour  le  rdglage  de  difference  de  pression  le  plus  eieve  et  conduira  done  3  une  acceleration 
plus  rdgulidre  de  la  machine. 

On  a  done  mtdr§t  3  choisir  un  rdglage  du  clapet  differentiel  aussi  eieve  que  possible  aux  deux  conditions 
suivantes  pres  : 

-  qu'il  permette  une  acceleration  suffisante  de  la  machine  jusqu'3  la  moitie  de  la  vitesse  nominal** 

-  que  le  plein  regime  de  la  machine  soit  obtenu  pour  des  valeurs  de  Qg  raisonnables c'est-3-dire  ne  con- 
duisant  pas  3  surdimensionner  1 ' eicctropompe. 


5.2.  Partie  dlectrique 

L'interface  entre  la  partie  hydraulique  et  la  partie  dlectrique  est  assurde  par  1 'dlectropompe. 


5.2.1.  Electropompe 

Celle-ci  est  composde  d'une  classique  pompe  3  engrenages,  done  du  type  volumdtrique,  entrai- 
nde  par  un  moteur  dlectrique  3  excitation  inddpendante.  On  salt  que,.  pour  un  tel  moteur,  si  l'excitation  est 
constante,.  la  vitesse  de  rotation,  et  par  13,  le  debit  de  carburant  fourni  par  la  pompe,.  est  une  fonction 
quasi  lindaire  de  la  tension  qui  alimente  l'induit  :  QE  =  f  (Up). 

II  faut  noter  des  maintenant  que  si  en  fonctionnement  normal  autour  du  point  de  regulation 
peut  considdrer  que  la  tension  d'excitation  est  constante,  il  en  va  tout  autrement  pendant  la  phase  de  ddmar- 
rage.  En  effet,.  celui-ci  est  gdndralement  rdalisd  par  un  moteur  dlectrique  puissant  et  ayant  done  une  consom¬ 
mation  importante  puisque  de  l'ordre  de  quelques  centaines  d'ampdres.  Celle-ci  entraine  done  une  chute  de  ten¬ 
sion  importante  de  la  source  et  il  est  frequent,  en  particulier  lors  de  ddmarrages  realises  sur  batterie,  de 
voir  la  tension  descendre  3  60  %  de  la  tension  nominale.  Ce  phdnomdne  peut  Stre  particulidrement  gdnant  puis¬ 
que  pendant  la  phase  delicate  du  ddmarrage,  toutes  les  fonctions  de  transfert,  y  compris  celle  de  la  pompe, 
vont  dvoluer. 

Fort  heureusement ,  le  moteur  se  comporte  comme  un  moteur  shunt  et  sa  vitesse  augtrente  done 
lorsque  l'excitation  diminue  ce  qui  provoque  done  une  sorte  "d'auto-compensation".  Pour  pouvoir  fournir  le 
debit  maximum  de  200  1/h  sous  une  pression  de  12  bars  en  tenant  compte  d'un  rendement  global  de  0,4,.  il  faut 
disposer  d'un  moteur  d'une  puissance  de  l'ordre  de  240  Watts,  soit  une  intensite  maximale,  pour  une  tension 
d'alimentation  de  24  V,  de  l'ordre  de  10  amperes. 


5.2.2.  Ddcoupeur 

Un  courant  de  10  amperes  peut  §tre  actuellement  facilement  commandd  par  un  transistor.  Celui- 
ci  peut  Stre  utilise,  soit  en  "ballast",  c 'r st-3-dire  se  comporter  grossidrement  comme  une  resistance  va¬ 
riable,  soit  en  "ddcoupeur" ,■  c'est-3-dire  fonctionner  en  "tout  ou  rien". 

La  deuxidme  solution  est  la  plus  avantageuse  au  point  de  vue  de  la  dissipation  thermique  et 
permet  d'augmenter  ia  suretd  de  fonctionnement  du  transistor  et  de  diminuor  la  masse  du  radiateur  chargd 
d'dvacuer  les  calories.  En  effet,.  dans  le  fonctionnement  en  ballast,-  on  est  amend  3  dissiper  dans  le  transis¬ 
tor  la  difference  entre  la  puissance  d'entrde,  c'est-3-dire  le  produit  de  la  tension  batterie  par  le  courant 
absorbd  par  le  moteur,  et  la  puissance  aux  bornes  du  moteur. 

Or,  comme  l'on  doit  Stre  capable  de  fonctionner  m§me  avec  des  tensions  d'alimentation  relati- 
vement  basses,  on  est  amend  3  choisir  un  moteur  capable  de  fournir  le  ddbit  maximal  3  la  sortie  de  la  pompe 
pour  une  tension  de  l'ordre  de  22  3  25  Volts.  On  doit  done  dissiper  au  minimum  40  Watts  dans  le  ballast.  La 
dissipation  est  encore  plus  dlevde  pendant  la  phase  de  ddmarrage  ou  l'on  ddsire  des  ddbits  plus  faibles.  Par 
contre,  dans  le  cas  d'un  transistor  travaillant  en  ddcoupeur,  on  ne  dissipe  que  : 

-  la  puissance  perdue  du  fait  de  la  chute  de  tension  collecteur-dmetteur  pendant  que  le  tran¬ 
sistor  est  conducteur  (soit  I.Vce) 

-  la  puissance  perdue  par  les  pertes  de  commutation  lorsque  le  transistor  passe  de  l'dtat  pas¬ 
sant  3  l'dtat  bloqud  et  inversement.  En  choisissant  bien  le  type  de  transistor  ulilisd,  on  peut  rendre  ces 
pertes  extrdraement  faibles. 

Nous  utilisons  des  transistors  Darlington  de  technologie  Mesa  triple  diffusion  pour  lesquels 

on  a  : 

-  un  temps  de  montde  tr  =  0,4  us 

-  et  un  temps  de  descente  tf  =  0,9  u s 

Prdsentd  en  boitier  T03  .Tumbo,  ce  transistor  3  une  mtensitd  collecteur  nominale  de  20  amperes 
et  une  mtensitd  de  pointe  de  40  amperes  ;  il  peut  dissiper  70  Watts  3  ^S^C.  Nous  avons  mesurd  en  fonction- 
uement  normal  un  rendement  global  variant  de  84  3  94  X,  les  plus  mauvais  rendements  dtant  obtenus  lorsque  la 
tension  d'alimentation  combe  aux  alentours  de  20  Volts  ce  qui  conduit  le  ddcoupeur  3  Stre  pratiquement  en 
conduction  continue.  Le  schdna  bloc  du  ddcoupeur  est  donnd  a  la  planche  6.  Il  s’agit  d'un  ddcoupeur  3  fre¬ 
quence  fixe  et  3  largeur  variable.  On  remarque  qu'il  comporte  une  boucle  de  rdgulation  interne. 
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A  1'entrAe  de  1 'amplificateur  de  regulation  R,  on  a 

-  la  tension  de  commande  provenant  de  l'Atage  de  regulation 

-  la  tension  "image"  de  la  tension  fournie  par  le  transistor  de  puissance.  Etanc  donne  que 
cette  tension  est  composee  d'une  suite  de  crAneaux  A  frequence  fixe  et  A  largeur  variable,  le  contenu  har- 
monique  trAs  riche  d'un  tel  signal  nous  a  oblige  A  realiser  un  filtre  actif  du  2Ame  ordre  qui  fournit  en 
sortie  une  tension  continue  fonction  de  la  tension  moyenne  fournie  par  le  dAcoupeur  A  la  pompe. 

-  la  tension  de  "pulse  au  demarrage".  Au  cours  des  essais,  nous  avons  constate  que  l'on  pou- 
vait  ameiiorer  le  dAmarrage  du  groupe  en  fournissant  pendant  une  brAve  pAnode  de  1' ordre  de  1  A  2  secondes, 
la  pleine  tension  d 'alimentation  A  1 'eiectropompe.  O'  ,  nup  de  tension  fait  dAraarrer  trAs  vite  le  moteur 
de  1 ’eiectropompe  et  l'A-coup  de  debit  qui  s'en  suit  templit  rapidement  les  canalisations  et  force  l'injec- 
teur  A  pulveriser  correctement  dAs  le  debut  de  la  sequence,  ce  qui  permet  de  realiser  trAs  rapidement  l'al- 
lumage  m§me  par  temps  trAs  froid.  L'amplificateur  de  commande  C  est  en  rAalitA  un  comparateur  qui  reqoit 
sur  1'une  de  ses  entrees  la  tension  de  sortie  de  l'amplificateur  R  et  sur  1 'autre  le  signal  provenant  d'un 
oscillateur  ou  plus  exactement  d'un  gAnArateur  de  rampes. 

Compte-tenu  de  la  bande  passante  du  moteur  de  1 'eiectropompe  et  de  la  turbomachine,  la  fre¬ 
quence  de  dAcoupage  a  AtA  choisie  relativement  basse,  de  l'ordre  de  250  Hz.  En  sortie,  a  AtA  dispose  un  cir¬ 
cuit  de  protection  qui  comporte  d'une  part  des  elements  passifs  destines  A  limiter  les  surosci llations  et 
d'autre  part  un  circuit  actif  qui  bloque  le  transistor  de  puissance  si  les  tensions  d'alimentation  des  am- 
plificateurs  ne  sont  pas  toutes  deux  prAsentes. 

Bien  entendu,  un  dAcoupeur  gAnAre  des  harmoniques  sur  un  trAs  large  spectre  et  il  a  fallu 

prendre  e.i  certain  nombre  de  dispositions  pour  respecter  les  normes  dans  le  domaine  des  interferences  radio- 

Alectriques.:  Celles-ci  sont  ie  deux  types. 

Tout  d'abord  au  point  de  vue  technologique,  1 'ensemble  du  dAcoupeur  a  AtA  mcorporA  dans  le 
corps  du  moteur  de  pompe  ce  qui  realise  un  excellent  blindage.  D'autre  part,  des  filtres  ont  AtA  placAs  dans 
les  lignes  d'alimentation  du  transistor  de  puissance  et  dans  la  ligne  de  retour  A  la  masse  du  moteur. 

Au  point  de  vue  de  la  fonction  de  transfcrt  de  i 'ensemble  dAcoupeur,  nous  avons  dAjA  note  que 

le  filtre,  placA  dans  la  boucle  dt  retour,  est  du  2Ame  ordre.  Le  rAgulateur,-  quant  A  lui,.  est  un  rAseau  in- 

tAgrateur  qui  annule  l'erreur  statique  et  assure  un  dAphasage  nul  pour  les  frequences  AlevAes.  Ce  dernier 
point  est  particuliArement  important  du  fait  que  le  filtre  du  deuxiAme  ordre  apporte  un  dAphasage  pour  les 
frequences  AlevAes. 


5.2.3.  Regulation 


Celle-ci  comporte,.  en  rAalitA,  deux  elements  diffArents  :■ 

-  d'une  part,  une  regulation,  au  sens  strict  du  terme,  qui  assure  que  le  paramAtre  rAgulA,  dans 

notre  cas  ]a  vitesse  de  rotation  de  la  turbomachine,  est  bien  Agal  A  la  consigne,. 

-  d'autre  part,,  un  rAseau  d'Alaboration  de  consigne  qui,  A  partir  d'un  certain  nombre  de  pa- 

ramAtres  qui  peuvent  Atre  soit  des  rAglages,.  soit  des  variables  comme  la  vitesse  de  rotation,  soit  des  affi- 

chages  de  commande,  Alabore  la  consigne  qui  sera  comparAe  A  la  vitesse  vraie  A  1'entrAe  du  rAgulateur. 


5. 2. 3.1.  Convertisseur  frequence  tension  et  rAgulateur  P  l.D. 

Nous  passerons  rapidement  sur  les  elements  du  rAgulateur  proprement  dit  et  du  con¬ 
vertisseur  frAquence-tension  qui  ne  prAsentent  pas  d'onginalitA  particuliere.  La  mesure  de  la  vitesse  est 
rAalisAe,  A  partir  du  signal  fourni  par  un  capteur  A  reluctance  variable,  par  un  convertisseur  frAquence- 
tension  classique.  Celui-ci  comprend  : 

-  un  amplificateur  de  raise  en  forme 

-  un  rAseau  pseudo-dArivateur 

-  un  monostable 

-  un  filtre  adaptateur  d'impAdance  rAalisA  d'une  mamere  similaire  A  celui  utilise 

dans  le  dAcoupeur. 

A  la  sortie,  on  cbtient  une  tension  continue,  fonction  de  la  frequence  du  signal  dA- 
livrA  par  le  capteur,  ayant  une  trAs  bonne  linAantA  et  un  taux  d'ondulation  rAsiduelle  tres  laible.  Le  rA¬ 
gulateur  P.l.D.  est,  lui-aussi,.  trAs  classique.  II  fait  subir  au  signal  d'erreur,  qui  nait  de  la  comparaison 
de  la  consigne  et  de  la  tension  fournie  par  le  convertisseur  irAquence-tension  : 

-  une  amplification  de  gam  K  ( proport  lonnel ) 

-  une  intAgration  de  constante  de  temps  T  (intAgral) 

-  une  avance  de  phase  de  merae  constante  de  temps  T  (derivation) 

II  faut  noter  que  ce  rAgulateur  P  I.D.,  employe  seul.  prAsenterait  de  nombreux  incon 
vAnients.  Examinons,  par  exemple,  ce  qui  se  passe  au  debut  du  dAmarrage  :• 

-  la  consigne  externe  est  maxiroale 

-  la  vitesse  est  nulle 

L'erreur  A  1'entrAe  est  done  maximale.  Le  rAgulateur  P.l.D.  va  done  voir  sa  tension 
de  sortie  croltre  jusqu'A  sa  valeur  maximale,  c'est-A-dire  jusqu'A  la  valeur  de  sa  propre  tension  d'alimen- 
tation.  Le  condensateur  de  1 ' intAgrateur  va  se  charger  sous  cette  tension  et  on  est  conduit  A  une  saturation 
Celle-ci  ne  cessera  que  lorsque  le  condensateur  sera  complAtement  dAchargA  ce  qui  peut  prendre  un  temps  suf- 
fisamrient  long  pour  que  la  machine  passe  en  survttesse  compte-tenu  de  ses  faibles  temps  de  rAponse.  C'est 
pour  cette  raison  que  l'on  recherche  toujours  a  se  placer  dans  le  cas  ou  l'erreur  est  tres  petite  D'autre 
part,  il  ne  faut  pas  oublier  que  de  tels  phAnomencs  peuvent  conduire  A  des  taux  d 'acceleration  inacceptables 
tant  du  point  de  vue  mAcanique  que  du  point  du  vue  thermodynamique. 


5, 2. 3. 2.  Elaboration  da  consigns 
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Le  r*a«u  d 1 tflaborat ton  de  consign*  dScrit  A  la  plsncht  7  sgit  dans  trois  devoir** 
qui,  tout  en  dtant  dlstincts,  sont  116s  lee  uni  lux  autre*  : 

-  le  contrOle  d ' acceleration 

-  la  limitation  de  la  tension  de  sortie  en  fonctlon  de  la  vitesae 

-  la  limitation  de  la  tension  minimale  de  la  tension  de  sortie 


5.  2.  3.  2.1,  ContrMe  d  'acceleration 

La  consigne  "vraie"  peut  Stre  un  Bignal  fixe  ou  variable,  cette  variate 
pouvant  elle-mfime  £tre  pseudo-cont inue  (par  exemple  potent lomfctre  de  commando  de  vltesse)  ou  par  echelon 
(commando  ralentl  -  pleln-gaz).  Le  trLgger  d'entrde  est  un  ampl If icateur  &  tri-s  grand  gain  qui  ne  peut  avoir 
quo  trois  dtats  de  sortie  : 

-  §tre  A  la  tension  d 'al (mentation  positive,  ce  qui  est  obtenu  lorsque  le 
signal  sortant  du  sommateur  place  A  son  entrde  est  positif 

-  fitre  flu  zgro  lorsque  le  sommateur  lui  fournlt  une  tension  nolle 

-  Stre  h  sa  tension  d ' alimentation  negative  ce  qui  est  obteau  lora.-e  !e 
signal  sortant  du  sommateur  place  A  son  *uitr£e  est  ndgatif 

Le  signal  de  sortie  du  trigger  est  envoy£,  A  travers  un  rlseau  diviseur 
&  I'entrle  de  l ' Integra teur.  Si  celui-ci  re^oit  un  "plus",  il  fournit  en  sortie  une  rampe  croissante  de  pence 
constante,  pulsque  la  tension  A  son  entree  est  constant*.  Cette  pente  est  d'aiileurs  reliable  de  caaniLre  A 
pouvoir  s’adapter  aux  dlfferentes  turbomachines.  Si  la  tension  d'entrde  passe  par  zero,  11  reate  A  la  tension 
ou  il  se  trouvait.  Si  la  tension  d'enlrde  est  negative,  il  fournit  en  sortie  une  rampe  dlcroi ssante.  On  re- 
marque  que  la  sortie  de  l * lnt£grateur  est  rebouciee  sur  le  sommateur  plac£  devant  1 ' intlgrateur ,  ce  qui  per- 
met  d'arrftter  la  rampe  lorsque  celle-ci  a  atteir.t  le  niveau  de  la  consigne  vraie. 

GrAce  A  ce  dispositlf,  tout  Echelon  de  consigne  vraie  sera  transferal  en 
rampe  croissante  ou  decroissante  suivant  le  sens  de  variation  de  I'dchelon.  On  peut  voir  que  les  deux  autres 
lignes  arrlvant  A  I'entrde  de  1 ' integrateur  permettent  de  limiter  par  valeur  maxlmale  ou  par  valeur  mini male 
le  signal  issu  du  trigger.  Nous  montrerons  l'utilitd  de  ces  limitations  plus  loin. 

Une  fois  que  1 'action  de  limitation  sera  terminde,  on  obtiendra  en  sortie 
de  1 1 integrateur  une  rampe.  C'est  cette  rampe  qui  sera  comparge  A  la  vitesse  afin  de  commander  la  regulation. 
Le  dispositlf  fonctionne  alors  de  deux  manibres  legirement  dlfferentes  suivant  la  phase  de  f onct i onnement  od 
I'on  se  trouve. 

Trois  cas  peuvent  se  presenter  : 

ler  cas  :  la  machine  accMAre  normalement  et  suit  la  rampe  de  sortie  du 
g£n£rateur  de  consigne  interne.  Dans“ce“cas,  le  systfcme  fonctionne  de  la  mfime  Caqon  en  tout  point,  du  d£o*r- 
rage  au  plein  gaz.et  en  chaque  point  la  vitesse  «st  r£guiee  par  le  P.I.D.  au  point  consider^. 

2£me_cas  :  la  machine  accdlAre  trop  vite.  Dans  ce  cas,  la  grandeur  de  sor¬ 
tie  diminue  sous  I'action  du  r^gulateur  jusqu'A  la  valeur  du  "mini-pompe"  (cf.  5  5.2. 3.2.3.). 

3eme  cas  :  la  machine  n'accgi&re  pas  ou  faiblement.  Dans  ce  cas,  la  gran¬ 
deur  de  sortie  augmente  sous  I'effet  3u  rlgulateur  Jusqu’au  moment  ou  elle  atteint  la  valour  de  limitation 
(cf.  §  5. 2. 3. 2. 2.).  A  partir  de  ce  moment,  la  consigne  interne  est  ramende  A  la  valeur  de  la  vitesse  et  ellc 
y  restera  Jusqu'A  ce  que  la  machine  accepte  d'accdldrer.  La  consigne  interne  sera  alors  libdr^e  selon  la 
rampe  de  sortie  de  son  dispositlf  d * eiaborat ion.  On  volt  done  que  dans  ce  f onct l onnement ,  1 'acc£l£rat Ion  est 
limltde  A  une  valeur  supdrleure, 

Lorsque  i'on  commande  une  variation  de  vitesse  A  partir  d'un  regime 
hi l. par  exemple  en  effectuant  une  commande  ralentl -plein  gaz.  ou  inversoment,  la  regulation  va  fatre  en  se  e 
que  l’dcart  entre  la  vitesse  et  la  consigne  interne  rest*  nul ,  ce  qui  revient  A  dire  que  la  courbe  d'dv< 
tion  de  la  vitesse  va  sulvre  celle  de  la  consigne  et  ceci  const  itue,  en  fait,  une  regulation  dMccdldra*. 
ft  de  ddcdldrat ion. 


5. 2. 3.2. 2.  Limitation  de  la  valeur  maximale  de  sortie 


Le  dispositif  fonctionne  de  la  man J fere  sulvante.  On  additionne  : 

-  une  tension  fixe,  nominee  "scull"  avec 

-  une  tension  propor U onnel le  A  la  vitesse  de  rotation  et  neeusde,  ietpropre- 
ment  d ' n ‘ t leurs ,  "limitation",  el  on  compare  cette  somme  A  la  tension  de  la  grandeur  de  sortie. 

L'erreur  est  ampl Hide,  puis  envoyde  A  1 ' integrateur  d ' eiaborat ion  con¬ 
signe  pur  l ' i ntermddi alre  d'une  diode.  Cette  diode  est  polar isde  de  maniere  A  ce  qu’elle  soit  : 

-  passant?  dans  le  sens  integrateur  vers  ampl i f icateur  de  luaitatio; 

-  hloqude  dans  le  sens  inverse 

Ceci  veut  dire  quo  la  diode  sera  passant?  lorsque  1' ampl l  do  limitation 
demandet-a  une  diminution,  c'est-A-dire  lorsque  la  tension  de  la  grandeur  de  sortie  sera  plus  grande  que  la 
somme  du  "seuil"  et  de  la  "limitation".  La  diode  en  devenant  passant r  fait  en  tort*  que  la  tension  de  sor¬ 
tie  du  rdgulateur  soil  £gale  A  U  "limitation"  •  V  "seuil",  l\n  sens  inverse,  c'est-A-dire  lorsque  la  .randeur 
de  sortie  est  plus  petite  que  In  somme  du  "seuil"  el  de  la  "limitation",  I'ampli  de  limitation  dem;  ivra  un? 
augmentation,  la  diode  se  hloque  et  ce  circuit  n*  tnt  ervieitt  plus.  On  aura  done  toujour  a  U  sortie  v  ^limi¬ 
tation"  *  U  "seuil").  La  valeur  de  V  "seuil"  est  rdglable  au  niveau  du  bottler  de  mvrne  que  l*  "limit  ion".  D* 
plus,  on  peut,  par  commutation,  neutraliser  I'action  de  U  "limitation"  Jusqu'A  un  certain  seuil  de  \itessev 


tant  du  d<hut  de  demurrage  ; 


Vovons  maintenant  1'utUUe  de  ce  circuit,  1'laqons  nous  d'abord  Pins- 

-  la  vitesse  est  nolle,  done  V  "limitation"  est  nul 
•  la  grandeur  de  sortie  est  mills 


La  sortie  du  trigger  etant  au  plus,  1 ' integrateur  comn«nc«  A  tournir  une 
rampe,  Celle-ci  est  unvoyde  au  rlgulateur  P,  1,0,  qui  la  revolt  en  totality  pulsque  la  vdtm  cat  nulli* 
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Ceci  fait  done  immEdiatement  monter  la  grandeur  de  sortie,  avant  m&ne  que 
la  vitesse  n'augmente.  DSs  que  la  tension  de  sortie  est  Egale  au  "seuil",  la  diode  devient  passante.  Si  1'on 

veut  que  la  grandeur  de  sortie  du  rEgulateur  reste  limitEe  au  seuil,  il  faut  que  le  sommateur  d'entrEe  du 

P.I.D.  soit  E  zEro,;  c'est-E-dire  que  la  consigne  interne  soi t  Egale  a  la  vitesse. 

La  vitesse  ayant  une  certaine  valeur,  il  faut  que  la  consigne  interne 
baisse  et  pour  cela,  il  suffit  que  le  condensateur  d'intEgration  du  circuit  d 1  Elaboration  de  consigne  se  dE- 
charge  a  travers  la  diode.  La  constante  de  temps  de  cette  dEcharge  Etant  environ  100  fois  plus  faible  que 
celle  de  1 ' intEgration,  on  constate  une  chute  rapide  de  la  consigne  interne.  Celle-ci  s'arrete  a  une  valeur 
telle  que  la  vitesse  soit  Egale  a  la  consigne  interne  (si  cela  est  possible  compte-tenu  du  rEglage  de  la  va¬ 
leur  minimale  :•  cf  §  suivant).  Ce  dispositif  permet  done,  pendant  les  premiers  instants,  d'injecter  ce  qu'il 

faut  pour  allumer  et,-  si  la  vitesse  ne  monte  pas,-  d'injecter  un  minimum  de  carburant 

Si  nous  nous  plaqons  a  une  vitesse  quelconque,  non  nulle,  U  "limitation" 
vient  se  rajouter  a  U  "seuil"  et  le  fonctionnement  est  similaire.  Ceci  signifie  done  qu'E  toute  vitesse  cor¬ 
respond  une  grandeur  maximum  de  sortie  qui  ne  peut  Etre  dEpassEe. 


5. 2. 3. 2. 3.  Limitation  de  la  valeur  minin.ale  absolue  de  la  sortie 

On  sait  que  tout  moteur  Electrique  a  besoin  d'une  tension  minimale  a  ses 
bornes  pour  dEmarrer..  Or,  il  peut  se  faire,  dans  les  transitoires  de  rEgulation,.  que  la  tension  de  sortie 
soit  nulle.  Le  moteur  aurait  tendance  a  s'arrEter  avant  que  cette  valeur  soit  ntteinte  et  ne  pourrait  repar- 
tir  qu'au-dessus  d'une  certaine  tension. 

Par  example,  au  dEbut  du  dEmarrage,  si  le  moteur  Electrique  de  lancement 
fourmt  une  accElEration  supErieure  a  1 ' accElEration  maximale  autorisEe  par  le  boitier,  la  tension  de  sortie 
irait  a  zEro.  Pour  Eviter  cela,  or.  a  muni  le  systeme  d'une  limitation  basse  qui,  en  tout  Etat  de  cause,  im- 
posera  a  la  tension  de  sortie  une  valeur  minimale  en  dessous  de  laquelle  on  ne  peurra  descendre  :■  "le  mini- 
pompe". 

Le  dispositif  est  similaire  a  celui  de  la  limitation  maximale,  iriis,  bien 
entendu,  la  diode  qui  permet  le  raccordement  sur  1'entrEe  de  1 ' intEgrateur  de  1 'Elaboration  de  consigne  est 
polarisEe  en  sens  inverse.  Il  faut  bien  noter  que  cette  tension  minimale  imposEe  au  moteur  correspond  a  une 
vitesse  de  rotation  minimale,,  done  a  un  dEbit  minimal. 


6.  MISE  AU  POINT  ET  RESULTATS  OBTENUS 


Les  travaux  de  mise  au  point  ont  dEbutE  par  la  dEtermination  des  rEglages  optimaux  du  clapet  diffErentiel. 
En  particulier,  ainsi  que  nous  l'avons  dit  prEcEdemment,.  il  faut  tenir  compte  de  toutes  les  pertes  de  charge 
du  circuit  de  retour  rEel  qui  dEplacent  le  dEbut  de  la  courbe  Qp  =  f  (Up).  Nous  avons  aussi  recherchE  s'il 
Etait  intEressant  de  modifier  le  gain  tres  important  autour  du  point  de  rEgulation  nominal.  Cette  action  est 
possible  mais  peu  incEressante  car  la  marge  de  gain  du  systEme  est  largement  suffisante.  Les  rEglages  du  rE- 
gulateur  Electronique  sont  faciles  et  classiques.  Le  scul  point  intEressant  est  la  recherche  de  la  valeur  du 
gain  proportionnel  compatible  avec  tous  les  types  de  fonctionnement.  Il  importe  en  effet  de  bien  vErifier 
1 'action  de  toutes  les  perturbations  possibles.  On  peut  voir  sur  le  schEma  de  la  planche  8  que  ces  perturba¬ 
tions  sont  fort  nombreuses  et  agissent  sur  plusieurs  Equipements. 

En  ce  qui  concerne  le  G.A.P.  ,  1 ' accElEration  maximale  tolErEe  peut  prendre  deux  valeurs  :•  E  basse  vitesse 
on  autorise  une  accElEration  plus  faible  car  on  n'a  pas  d'obligation  particuliEre  en  ce  qui  concerne  le  temps 
de  dEmarrage,  Les  rEsultats  obtenus  tant  en  conditions  simulEes  qu'en  utilisation  rEelle  sont  trEs  bons  tant 
au  niveau  de  la  fiabilitE  qu'au  niveau  des  performances.  Le  systEme  de  dEmarrage  a  accumule  raaintenant  plu¬ 
sieurs  milliers  de  cycles  dans  toutes  les  conditions  d 'environnement.  On  a  surtout  remarquE  la  suretE  du  dE¬ 
marrage  E  tres  basse  tempErature  grace  E  l'emploi  du  "pulse"  au  dEmarrage. 

Le  groupt  autonome  de  puissance  a  dEraontrE  en  utilisation  rEelle  une  enveloppe  de  fonctionnement  beaucoup 
plus  large  que  celle  prEvue  tant  dans  le  domame  de  1 'altitude,  puisque  1 'altitude  de  12  000  metres  a  pu  Etre 
atteinte,  que  dans  le  domaine  des  tempEratures  extrEmes,  puisque  des  dEmarrages  ont  pu  Etre  tentEs  avec  suc- 
cEs  jusqu'E  des  tempEratures  de  -  45°C,  E  l'aide  des  seules  batteries  alors  que  le  domaine  normal  de  dEmarra¬ 
ge  est  limitE  E  -  30°C 


7.  CONCLUSION 

Le  nouveau  systeme  de  commande  de  dEbit  de  carburant  a  dEmontrE  en  utilisation  une  tres  bonne  fiabilitE 
et  de  bonnes  performances..  Sa  simplicitE  en  fait  un  produit  facile  E  fabriquer  et  E  rEgler,  done  ayant  un 
pnx  de  revient  compEtitif. 
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Planche  2  :  S>st£me  a  Slectrcpompe  et  servovalve 
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Figure  6  :  Schema  bloc  du  d6coupeur 


Planche  8  :  Schema  bloc  d1 ensemble 
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DISCUSSION 


Prof.  Amoia,  It 

There  is  a  definite  trend  in  today  technology  towards  digital  control.  You  have  preferred  an  analog  solution.  Would 

you  please  comment  on  the  motivation  of  your  choice. 

Author’s  Reply 

(1)  Pour  une  fabrication  en  petites  quantites  les  systemes  analogiques  sont,  encore  actuellement,  beaucoup  moins 
cliers. 

(2)  D'autre  part  nous  avons  voulu  d’abord  verifier  le  fonctionnement  de  ce  systeme,  dont  I’etage  de  puissance  est 
pratiquement  numerique  puisque  commande  par  des  creneaux,  avec  une  regulation  analogique  bien  connue. 

II  est  dans  notre  intention  d’utiliser,  dans  un  proche  avenir,  une  regulation  numerique. 

Translation 

( 1 )  Analog  systems  are  still  appreciably  cheaper  for  small  production  quantities. 

(2)  Apart  from  this,  we  first  of  all  wanted  to  check  the  operation  of  this  system,  whose  power  stage  is  practically 
numerical,  as  it  is  controlled  via  teeth  (serrations,  cams)  with  a  well-known  analog  control.  We  intend  utilising 
numerical  control  shortly. 


TRANSDUCERS  FOR  ENGINE  CONTROL  SYSTEMS 


G.E.  Davies,  C.Eng.,  M.R.Ae.S.,  M.I.tlech.E. , 
Technical  Manager,  Fluidics, 

Plessey  Aerospace  Limited, 

Abbey  Works, 

Titchf ield, 

Fareham, 

Hants.  POH  4QA 


SUMMARY 


The  analysis  of  engine  control  requirements  shows  that  two  types  of  parameters  must  be  measured. 
Non-dimensional  parameters  are  required  for  performance  and  handling  work,  whereas  dimensional  parameters 
such  as  pressure  and  temperature  are  required  for  structural  protection. 

Conventional  transducers  measure  the  dimensional  or  structural  parameters  which  means  that  the  non- 
dimensional  performance  terms  must  be  computed  from  the  structural  parameters.  This  leads  to  inaccuracies, 
particularly  at  high  altitude  where  the  dimensional  quantities  may  represent  only  a  small  percentage  of 
the  transducer  scales,  and  because  of  this  the  system  designer  may  be  forced  to  chose  non-optimum  parameters 
for  the  control  system. 

This  paper  describes  some  active  fluidic  transducers  which  measure  the  fundamental  non-dimensional 
quantities  required  for  engine  control  systems.  The  use  of  these  transducers  offers  a  true  non-dimensional 
measurement  of  engine  performance  and  allows  the  system  designer  a  freer  choice  of  control  parameters. 


SYMBOLS 

K  Arbitrary  Constant 

N  Shaft  Speed 

T  Air  Temperature  (Total) 

W  Air  Mass  Flow 

P  Air  Pressure  (Total) 

p  Air  Pressure  (Static) 

M  Duct  Mach  number 

H  Ratio  of  Specific  Heats 

A  Duct  Cross  Sectional  Area 

Rg  Cas  Constant 

Suffices  1  and  2  represent  arbitrary  stations  in  the  engine 


1.  INTRODUCTION 


The  first  gas  turbine  engine  controls  were  simple  systems  using  shaft  speed,  corrected  by  inlet  air 
temperature,  as  the  main  parameter.  This  was  a  natural  follow-on  from  the  control  of  piston  engines,  on 
which  speed  was  of  primary  importance.  Control  system  development  followed  from  these  beginnings,  and  led 
to  the  extensive  use  of  hydro-mechanical  controls  using  normalised  speed,  N/V/'T  t-,  the  control  parameter. 
Later  developments  introduced  pressure  ratio  as  a  parameter,  bat  the  mechanisation  of  the  control  was  aga 
by  hydro-mechanical  means  with  limited  computational  capability.  As  engine  performance  requirements  have 
become  more  stringent,  with  the  need  for  higher  performance  and  efficiency,  so  control  systems  have  had  to 
become  more  precise  and  have  had  to  manage  more  parameters.  This  is  especially  so  on  supersonic  aircraft 
where  flight  parameters  may  be  included  in  the  overall  control  equations. 

With  the  development  of  digital  electronic  computers  having  high  speed  and  great  computational  cap¬ 
acity  there  has  been  natural  trend  towards  full  digital  control  of  engines.  This  approach  has  allowed 
all  relevant  parameters  to  be  considered  in  the  control  equations,  but  equally  this  imposes  a  demand  for 
many  more  transducers.  A  simple  block  diagram  of  a  control  system  is  shown  in  Figure  1,  and  it  is  clear 
that  input  transducers  are  required  to  supply  information  to  the  computer,  whilst  output  transducers  are 
required  to  enable  the  computer  to  control  the  engine. 


This  paper  discusses  some  particular  input  transducers  specifically  designed  for  aircraft  engine 
control  systems. 


2.  CONTROL  PARAMETERS 


Analysis  of  engine  control  requirements  shows  that  two  types  of  parameters  must  be  considered  for 
complete  and  effective  control.  These  are,  performance  parameters,  and  structural  parameters  as  shown  on 
Figure  2.  Performance  parameters  are  the  non-dimensional  or  normalised  quantities  used  to  measure  the 
thermodynamic  performance  and  stability  of  the  engine.  These  are:- 


Normalised  Speed 

N//T 

Pressure  Ratio 

P2/Pi 

Normalised  Mass  Flow 

w/T 

Temperature  Ratio 

p 

t2/tx 

\ 
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Structural  parameters  are  the  dimensional  quantities  relating  to  the  strength  and  life  of  the  engine 
and  are  used  simply  to  set  performance  limits.  They  are:- 

Shaft  Speed  N 

Temperature  T 

Pressure  P 

Conventional  transducers  measure  the  structural  parameters  directly,  since  they  usually  make  use  of 
physical  effects  generated  by  these  quantities.  For  example  in  a  pressure  transducer,  the  pressure  to  be 
measured  is  used  to  deflect  a  diaphragm  which  causes  an  electrical  element  to  be  distorted,  and  this  in 
turn  produces  an  electrical  signal  proportional  to  the  pressure  causing  the  distortion.  This  pressure, 
which  can  cause  distortion  of  the  engine  structure,  is  measured  by  making  use  of  the  same  effect  in  the 
transducers . 

Temperature  measurement  utilises  a  direct  physical  effect  although  in  a  somewhat  different  manner. 
Conventional  temperature  sensors  rely  on  a  direct  thermal  to  electric  effect,  either  in  a  thermocouple  or 
in  a  resistance  thermometer.  Measurement  of  shaft  speed,  which  is  necessary  to  prevent  overstressing  of 
of  utating  parts,  also  originally  depended  on  centrifugal  effects  on  flexible  sensors,  although  direct 
measurement  of  speed  is  now  accomplished  by  the  use  of  inductive  and  optical  sensors  which  transduce  speed 
into  frequency  of  an  electrical  or  optical  signal. 

It  is  clear,  therefore,  that  conventional  transducers  provide  a  direct  means  of  converting  the  struc¬ 
tural  parameters  into  electrical  signals  suitable  for  input  via  analogue-to-digital  converters  into  the 
computer. 

With  this  background,  and  the  power  of  the  digital  computer,  it  is  natural  that  the  current  control 
system  design  philosophy  is  to  compute  the  performance  parameters  from  the  structural  parameters.  However, 
this  is  not  such  a  simple  process  as  it  might  appear,  and  it  is  appropriate  at  this  point  to  look  in  more 
detail  at  the  problems  involved. 

2.1.  N//T 


This  requires  measurements  of  shaft  speed  N,  and  air  temperature  T  to  be  made.  Shaft  speed  is  easily 
measured  using  an  inductive  or  optical  probe  to  produce  an  electrical  signal  whose  frequency  is  proportional 
to  speed,  Air  temperature  measurement,  however,  depends  on  heat  transfer  from  the  air  stream  to  the  sensing 
element,  usually  a  thermocouple  before  the  measurement  is  effective.  Thermocouple  response  can  be  reduced 
to  fractions  of  a  second  and  good  results  can  be  obtained  where  temperature  fluctuations  are  not  too  rapid 
to  be  followed  successfully.  However,  in  modern  multi-shaft  engines,  it  may  be  desirable  to  use  the  air 
temperature  at  some  intermediate  position  in  the  engine,  for  example  at  the  inlet  to  the  third  spool  of  a 
three  shaft  engine,  and  the  rate  of  change  of  air  temperature  may  reach  100°C  per  second  during  rapid  ac¬ 
celeration  or  deceleration.  The  accuracy  of  the  measurement  in  these  circumstances,  even  with  computerised 
compensation,  is  usually  unacceptably  low. 

This  problem  is  aggravated  by  the  fact  that  N/  -/T  is  a  very  non-linear  performance  parameter.  Idling 
thrust  may  occur  at  40 %  to  50%  of  maximum  N/-/T,  and  the  range  from  half  to  full  thrust  may  occur  between 
85%  and  100%  of  maximum  N/ /T.  Clearly,  to  obtain  good  performance  control,  a  very  high  accuracy  is  required 
in  the  measurement  of  N//T.  Engine  intake  temperature  is,  therefore,  used  as  the  parameter  in  order  to 
obtain  a  more  steady  and  hence  more  accurate  reading.  However,  this  approach  not  only  sacrifices  informa¬ 
tion  about  the  core  of  the  engine,  but  also  poses  the  problem  of  preventing  ice  formation  on  the  sensing 
element  in  adverse  weather  conditions. 

Nevertheless,  because  of  the  historical  use  of  engine  speed,  N/y  T  is  still  often  used  as  a  preferred 
parameter  in  spite  of  these  difficulties. 

2.2.  P2/Pt 

Pressure  ratio  requires  the  measurement  of  two  pressures  and  may  be  computed  in  the  form  P2/P1  or  as 

1  +  A  P  .  .  ,  ... 

— jq-  where  n  P  =  ?2  -  Pj.  This  is  an  ideal  parameter  for  monitoring  engine  performance  since  it  has 

an  approximately  linear  relationship  with  thrust.  Furthermore,  the  response  time  of  the  measurement  is 
effectively  independent  of  where  in  the  engine  the  measurement  is  taken.  It  is,  therefore,  possible  to 
monitor  pressure  ratio  in  several  places  and  deduce  the  "state  of  health"  of  the  engine  in  addition  to 
controlling  performance. 

The  major  problem  in  pressure  ratio  measurement  concerns  the  accuracy  obtainable  at  high  aKitude 
This  is  best  illustrated  by  the  following  example.  Suppose  overall  compressor  pressure  ratio  is  being 
measured  on  a  modern  high  efficiency  engine  where  the  maximum  ratio  is  30:1  and  the  accuracy  required  is 
+  2%.  At  sea  level  the  compressor  delivery  pressure  will  be  a  maximum  of  3040  KPa  and  so  the  appropriate 
pressure  transducer  must  be  capable  of  measuring  this  pressure.  However,  if  the  aircraft  is  able  to  oper¬ 
ate  at  an  altitude  of  16  km  where  the  atmospheric  pressure  is  about  10%  of  the  sea  level  value,  all  the 
pressures  in  the  engine  will  oe  similarly  reduced  to  10%  of  their  sea  level  values.  The  maximum  compres¬ 
sor  delivery  pressure  will  then  be  304  KPa,  and  if  the  engine  is  throttled  back  for  descent,  the  pressure 
may  fall  to  only  150  KPa.  For  an  overall  accuracy  of  +  27  in  pressure  ratio,  ?acn  pressure  must  be  meas¬ 
ured  to  better  I'nan  +  1%.  If  the  extreme  altitude  situation  is  to  be  catered  for,  the  transducer  connected 
to  compressor  delivery  pressure  must  measure  150  KPa  to  an  accuracy  of  +^  1%,  i.e.  to  +_  1.5  KPa.  This  same 
transducer  at  sea  level  must  equally  be  able  to  measure  up  to  3040  KPa,  so  the  accuracy  specif icatiion  for 
this  transducer  requires  +  1.5  KPa  in  3040  KPa,  i.e.  better  than  +0.05%  of  full  scale.  This  accuracy  must 
be  met  over  the  full  range  of  working  temperature  and  energising  voltage.  Clearly  this  is  a  difficult  task, 
and  similar  requirements  apply  to  all  other  pressure  transduceis  used  for  measuring  pressure  latio. 
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2.3.  wyf/p 


Logically,  this  requires  measurements  of  air  mass  flow,  temperature  and  pressure,  but  as  mass  flow 
would  require  the  entire  engine  air  flow  to  be  measured  an  alternative  approach  has  to  be  taken.  The  normal 
method  is  to  relate  W  /T  to  the  flow  Mach  number  at  a  suitable  station  in  the  engine  and  then  to  deduce 
P 

the  Mach  number  from  the  ratio  of  total  to  static  pressure.  The  problem  then  reverts  to  pressure  ratio 
measurement  and  is  covered  by  the  comments  in  the  previous  section. 

2.4.  T2/T1 


The  problems  associated  with  fast,  accurate  temperature  measurement  have  already  been  covered  in  Sec¬ 
tion  2.1.  and  because  of  these,  temperature  ratio  is  not  generally  used  as  a  performance  parameter.  It 
could,  however,  have  significant  value  in  engine  health  monitoring,  for  example,  if  both  pressure  ratio  and 
temperature  ratio  across  a  compressor  are  measured,  deterioration  will  become  evident  by  a  rise  in  tempera¬ 
ture  ratio  for  a  given  pressure  ratio.  In  this  situation,  steady  state  measurements  are  adequate  and  so 
the  problems  are  minimised. 

2.5. 


From  the  foregoing,  it  is  clear  that  N/VT  is  often  used  as  the  main  performance  parameter  because  of 
historical  development,  and  because  of  the  difficulty  in  measuring  the  alternative  parameters  using  conven¬ 
tional  structurally  oriented  transducers.  In  consequence,  information  regarding  engine  performance  is  lost 
and  deterioration  of  efficiency  with  age  cannot  be  detected.  The  use  of  pressure  ratio  in  conjunction  with 
normalised  mass  flow  or  with  temperature  ratio  would  provide  a  full  knowledge  of  the  engine  performance, 
together  with  an  indication  of  its  efficiency  or  "state  of  health."  This  approach  would  also  give  a  much 
more  linear  control  since  pressure  ratio  has  a  nearly  linear  relationship  with  thrust  whereas  N/-/T  does  not. 

If  this  approach  is  to  be  used  effectively  it  is,  therefore,  necessary  to  have  available  an  accurate 
means  of  transducing  pressure  ratio  into  an  electrical  signal,  suitable  for  a  computer  input. 

3.  THE  PRESSURE  RATIO  TRANSDUCER 


From  the  earlier  discussion  it  was  apparent  that  the  computation  of  pressure  ratio  from  individual 
pressure  measurements  gave  rise  to  considerable  inaccuracies  because  of  the  wide  range  of  pressure  variation 
with  altitude.  It  was,  therefore,  decided  to  utilise  the  fundamental  properties  of  compressible  flow  to 
generate  a  signal  which  would  be  purely  a  function  of  pressure  ratio,  without  being  dependent  on  the  actual 
pressure  level  or  altitude.  The  mechanisation  of  this  concept  was  achieved  through  the  use  of  fluidics. 


3.1. 


Figure  3  shows  a  block  diagram  of  the  Pressure  Ratio  Transducer  (PRT)  which  consists  of  an  engine 
mounted  unit  plus  an  airframe  mounted  amplifier  or  Pressure  Ratio  Processing  Unit  (PRPU). 

A  fluidic  oscillator,  driven  from  the  pressure  P2  generates  a  triangular  output  pressure  waveform  as 
shown  in  Figure  4A.  This  is  passed  into  a  modulator  element  which  takes  the  form  of  a  multi-input  switch. 

The  modulator  is  driven  from  P2  but  receives  an  additional  input  from  Pj  pressure.  In  the  absence  of  any 
pressure  ratio  information,  the  modulator  would  switch  at  the  zero  crossing  points  of  the  oscillator  waveform 
as  shown  in  Figure  4B,  giving  rise  to  a  rectangular  pressure  waveform  of  50%  duty  cycle.  The  pressures  P2 
and  Pi  act  on  the  secondary  inputs  of  the  modulator  in  such  a  way  as  to  bias  the  switching  point  above  or 
below  the  zero  line  on  the  triangular  waveform,  by  an  amount  proportional  to  the  ratio  P2/P1.  This  has 
the  effect  of  changing  the  duty  cycle  of  the  modulatoi  output  as  shown  in  Figure  5.  The  pressure  ratio 
information  has  thus  been  converted  into  a  pulse  width  modulation  of  the  modulator  output .  This  is  then 
transduced  into  an  electrical  signal  by  means  of  pizo-electric  crystals,  and  this  signal  is  transmitted  by 
cable  to  the  PRPU. 

In  the  PRPU  the  low  level  signal  is  amplified  and  converted  from  a  pulse  width  modulated  signal  into 
an  output  suitable  for  use  in  a  computer  or  other  electronic  control  system.  In  current  applications  the 
output  is  in  the  form  of  an  analogue  voltage  in  the  range  1  to  6  volts,  but  this  could  alternatively  be 
presented  as  a  digital  signal  by  a  suitable  alteration  to  the  PRPU  circuitry. 

The  engine  mounted  unit  is  shown  in  Figure  6,  and  the  fluidic  oscillator  and  modulator  can  be  clearly 
seen.  Also  visible  is  the  electrical  connector  which  covers  the  piezo  electric  crystal  housing.  The  three 
pipe  flanges  provide  connections  to  P2,  Pj  and  a  vent  spill  pipe.  The  PRPU,  mounted  in  the  airframe  is 
illustrated  in  Figure  7.  It  is  shown  here  as  a  separate  unit  but  could  equally  be  accommodated  as  a  card 
in  the  computer  installation. 

The  current  standard  of  PRT  is  designed  to  measure  pressure  ratio  in  the  range  P2/P1  -  5  to  10,  plus 
a  reduced  accuracy  range  up  to  P2/P1  “  15.  With  minor  modifications  the  overall  range  can  be  altered  up¬ 
wards  or  downwards  by  approximately  50%.  By  the  use  of  the  fluidic  technology,  the  unit  measures  pressure 
ratio  as  a  fundamental  parameter,  and  is,  therefore,  able  to  offer  a  measurement  accuracy  of  +  2 7,  over  an 
altitude  range  of  sea  level  to  18  km.  The  fluidic  unit  is  mounted  directly  on  the  engine  and  is  designed 
to  operate  at  a  temperature  in  excess  of  300°C.  This  limit  is  imposed  only  by  the  Piezo-electric  crystals 
and  the  electrical  insulation,  and  an  experimental  unit  has  run  successfully  at  a  temperature  of  450°C, 

A  typical  calibration  is  shown  in  Figure  8,  and  an  accuracy  plot  is  given  in  Figure  9. 


The  development  of  the  pressure  ratio  transducer  enables  pressure  ratio  to  be  measured  as  a 
tal  performance  parameter  with  constant  accuracy  over  the  engine  operating  range.  In  consequence 
dimension  has  been  added  to  control  system  design. 


fundamen- 
a  new 
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4.  NORMALISED  MASS  FLOW 

From  compressible  flow  relationships  it  can  be  shown  that  the  rat'o  of  total  to  static  pressure  in 
duct  is  related  to  the  flow  Mach  number  in  the  duct  by  the  expression: 

P 
P 

which  for  air  (if1  1.4)  reduces  to: 


1  +  H 


x 

t-l 


P  =  (1  +  0.2  M2)  3,5 

P 


It  can  also  be  shown  that  the  mass  flow  in  the  duct  is  related  to  the  Mach  number  by  the  expression: 
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which  for  air  reduces  to: 

W  -  1.1832  PA  x  M _ 

'/RfiT  (1  t  0.2  mV 

i.e.  W/T  -  1,1832  A  x  M _ 

p  (1  +  0.2  M2)3 

The  term  1 . 1832  A  is  constant  for  any  given  position  in  the  engine.  Hence: 

/rI 


w/T  -  ft  (M) 

P 

and  since  M  *  f 2  (P/p) 

Then: 

W/T  “  f3  (P/p) 

P 

Hence  the  normalised  mass  flow  in  a  duct  may  be  represented  as  a  unique  function  of  total  to  static 
pressure  ratio  P/p. 

If  the  pressure  ratio  transducer  already  described  is  connected  to  the  air  in  the  duct  as  shown  in 
Figure  10B,  the  total  pressure  P  replaces  P2  and  the  static  pressure  p  is  divided  down  by  an  orifice  pair 
to  a  value  Kp  which  replaces  F^.  The  PRT  still  measures  P2/PI  which  becomes  ■  P  .  and  so  it  has  now 

.  ?  P.  . 

effectively  become  a  transducer  for  normalised  mass  flow  W/T.  A  typical  calibration  is  shown  in  Figure  11. 

P 

A  normalised  mass  flow  transducer  can,  therefore,  be  offered  to  provide  measurement  of  a  valuable  per¬ 
formance  parameter  which  has  so  far  been  regarded  as  difficult  to  measure.  A  small  limitation  in  this  design 
is  that  the  resolution  is  low  at  very  low  duct  Mach  number  due  to  the  shape  of  the  calibration  curve,  but 
at  most  normal  working  conditions  good  resolution  is  obtainable. 

5. _ FURTHER  DEVELOPMENTS 


The  normalised  mass  flow  transducer  described  in  the  previous  section  is  ideally  suited  for  measure¬ 
ments  in  the  high  pressure  conditions  encountered  in  engine  compressors.  It  is,  however,  not  suited  to 
measurements  1.  ow  pressure  areas  such  as  engine  intakes  and  fan  streams  where  insufficient  pressure  is 
available  to  drive  the  fluidic  elements.  For  such  situations  an  alternative  approach  is  required,  and  use 
may  be  made  of  the  ability  of  the  duct  flow  to  deflect  a  jet  of  air  in  a  fluidiu  device  as  shown  in  Figure  12. 

As  was  stated  in  Section  3,  the  temperature  limitation  on  the  PRT  is  imposed  purely  because  of  tin 
piezo-electric  crystals  and  the  elctrical  insulation.  The  normal  maximum  working  temperature  is  300°C  al¬ 
though  operation  up  to  400°C  is  possible  for  short  periods.  Special  high  temperature  piezo-electric  material 
has  been  tried  which  has  a  capability  of  operating  at  over  600°C  although  to  date  this  material  has  only 
been  tested  in  a  PRT  at  450°C  because  of  a  test  rig  limitation.  Nevertheless,  the  capability  of  modifying 
the  PRT  to  work  at  very  high  temperatures  is  available  and  the  potential  has  been  successfully  demonstrated. 

Temperature  ratio  T2/Tj  was  mentioned  m  Section  2.4  as  a  useful  parameter  in  engine  health  monitoring. 
Whereas  thermocouples  could  be  used  to  provide  the  individual  temperature  measurements,  an  alternative,  and 
more  robust  solution  is  possible  using  fluidics.  Consider  air  from  the  compressor  at  pressure  P2  and  temp¬ 
erature  r,  passing  through  an  orifice  A,  along  a  duct  and  through  a  second  orifice  B  to  discharge  to  vent 
as  shown  In  Figure  13.  If  the  pressure  in  the  duct  is  Pp  and  the  temperature  is  Tp,  and  if  choking  flow 
exists  in  the  orifices  A  and  B  it  can  be  shown  from  simple  flow  analysis  that  Pp  is  related  to  P2  by  the 
expression:-  , — 

PD  =  ^A  x  /  TD  x  p2 

aB  7  1 2 

Where  A^  and  Ag  are  the  areas  of  the  orifices  A  and  B  respectively. 
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If  the  duct  is  maintained  at  compressor  inlet  temperature  Tj  fay  an  external  flow  as  shown  in  Figure  13, 
so  that  Tp  *  Tl  then  clearly: 

£2  ”  Ab  /T2 

pD  aA  J  Tl 

Hence  the  ratio  P2/pD  gtves  a  measurement  of  ^2^1'  Now  t^>e  ppT  already  available  to  measure  pres¬ 
sure  ratios,  so  if  Pp  is  connected  to  a  PRT  in  place  of  Pj  then  the  PRT  output  becomes  a  function  of  T2/T1. 
This  arrangement  is  shown  in  Figure  14.  Measurement  of  temperature  ratio  by  this  method  is  not  confined  to 
compressors,  as  the  robust  nature  of  the  equipment  would  allow  even  turbine  entry  temperature  to  be  used  in 
place  of  if  desired. 

One  further  development  which  deserves  mention  is  the  possibility  of  replacing  the  electrical  link 
between  the  PRT  and  the  PRPU  with  an  optical  link.  Some  work  has  been  carried  out  to  develop  an  optical 
output  pressure  sensor  which  can  be  incorporated  into  a  PRT  in  place  of  the  piezo-electric  crysals.  An 
optical  fibre  link  would  then  carry  the  signal  to  a  modified  type  of  PRPU  where  it  would  be  converted  to 
an  electrical  signal  suitable  for  use  in  the  electronic  control  system  as  at  present.  The  advantage  of 
this  development  is  that  the  optical  link  is  completely  free  from  any  possible  electrical  interference,  and, 
therefore,  it  is  possible  to  eliminate  from  the  PRPU  the  existing  interference  rejection  circuit.  This  in 
return  releases  the  fluidic  system  from  a  particular  frequency  constraint  and  allows  it  to  be  worked  at  its 
optimum  oscillator  frequency  of  350  to  450  Hz,  resulting  in  a  significant  improvement  in  signal-noise  ratio 
and  response. 

6.  CONCLUSION'S 


Conventional  transducers  are  designed  to  measure  structural  parameters  such  as  shaft  speed,  air  temp¬ 
erature  and  air  pressure.  The  use  of  such  transducers  to  determine  the  engine  performance  parameters,  norm¬ 
alised  shaft  speed,  pressure  ratios,  and  normalised  mass  flow,  leads  to  an  unsatisfactory  situation.  Pressure 
ratio,  and  normalised  mass  flow  are  very  difficult  to  measure  to  an  acceptable  degree  of  accuracy,  and  the 
use  of  normalised  shaft  speed  as  the  main  control  parameter  leads  to  non-optimum  control  system  design. 

A  fluidic  pressure  ratio  transducer  is  available  which  measures  pressure  ratio  as  a  fundamental  para¬ 
meter,  and  thereby  offers  a  direct  and  accurate  measurement  over  a  wide  range  of  operating  conditions.  The 
use  of  this  device  offers  the  system  designer  a  means  of  measuring  one  of  the  fundamental  engine  performance 
parameters,  and  opens  the  door  to  greater  optimisation  of  system  design. 

The  pressure  ratio  transducer  can,  in  a  modified  form,  also  provide  a  measurement  of  normalised  mass 
flow,  so  that  a  second  fundamental  performance  parameter  can  be  monitored.  Further  developments  include  the 
possibility  of  using  the  basic  transducer  to  measure  temperature  ratio  for  engine  health  monitoring,  and 
also  the  development  of  an  optically  coupled  unit  having  an  improved  signal-noise  ratio  and  a  faster  response. 
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DISCUSSION 


David  J. Hawes,  Ca 

Compared  with  conventional  Parameters. 

NA/Teasy  to  measure,  %/TT reduces  effect  of  temperature  inaccuracy 
Pressure  Ratio 

Weight,  cost  and  reliability  comparison  with  “conventional”  pressure  ratio  systems 
Problems  of  changes  in  pressure  profile  over  flight  envelope 

Author’s  Reply 

1  agree  that  N/\/T7  is  easy  to  measure  because  intake  temperature  T,  covers  only  a  small  range  and  does  not  change 
rapidly.  However,  this  parameter  does  not  provide  all  of  the  information  about  the  core  of  a  multispool  engine  For 
example,  the  important  parameter  relating  to  the  HP  spool  in  a  3  spool  engine  would  be  N^/v/TT  where  is  the 
HP  spool  speed  and  T3  the  HP  intake  temperature  (or  IP  compressor  discharge  temperature). 

The  measurement  of  T3  is  much  more  difficult  than  T, ,  particularly  because  the  rate  of  change  of  T3  may  exceed 
100°C/sec  in  a  rapid  acceleration.  Because  of  this  N^/\/Ti  is  normally  used,  with  consequent  loss  of  information 
about  the  exact  working  condition  of  the  HP  spool.  Pressure  ratio,  however,  can  be  measured  quite  easily  and  it  is 
therefore  a  simple  matter  to  monitor  the  pressure  ratio  P3/P4  across  the  HP  compressor. 

Conventional  pressure  ratio  sensors  using  bellows  and  levers  are  generally  bulky  and  subject  to  failure  in  severe 
temperature  and  vibration  environments. 

Regarding  the  cost  comparison  I  can  only  refer  to  a  very  early  fluidic'  pressure  ratio  sensor  with  a  hydro-mechanical 
interface  This  unit  costs  approximately  60', '<  of  the  cost  of  the  mechanical  system  it  replaced.  1  have  no  other 
direct  cost  comparisons. 

Regarding  distortion  of  measurements  over  the  flight  envelope,  this  has  been  no  problem. 


P.Brammer,  UK 

With  the  described  double  orifice  pressure  ratio  sensing  device  what  is  the  necessary  level  of  Tj  accuracy?  Also  what 
effect  would  air  released  m  the  intake  from  anti-icing  system  have  on  accuracy? 

Author’s  Reply 

You  are,  I  presume,  referring  to  the  temperature  ratio  sensor  The  air  in  the  duct  between  the  two  orifices  would  be 
cooled  to  the  Tj  temperature.  This  would  be  ensured  by  allowing  the  jet  from  orifice  A  to  blow  on  the  inside  walls 
of  the  duct  to  obtain  good  heat  transfer,  and  also  by  having  an  adequate  length  of  duct. 

The  use  of  an  intake  anti-icing  system  which  heats  the  intake  locally  could  of  course  change  the  sensed  value  of  f , , 
and  thereby  change  the  measurement  of  T2/T,  This  however  is  a  problem  common  to  all  systems  where  T,  is 
measured,  and  must  equally  apply  to  the  measurement  of  N/\/t7.  1  am  not  offering  a  solution  to  the  problems 
associated  with  T,  measurement,  but  simply  offering  a  new  parameter,  T2/T, ,  if  T,  is  available. 


G.Serovy,  US 

Please  clarify  the  answer  to  the  question  from  Canada  (concerning  the  effect  on  the  pressure  ratio  indication  of 
changes,  distribution  of  compressor  discharge  pressure  with  operating  point).  Where  in  the  annulus  is  the 
compressoi  exit  pressure  measured  and  with  what  type  of  sensor9 

Author’s  Reply 

In  the  particular  application  where  we  have  flight  experience  we  aie  not  aware  of  any  distortion  problem  affecting 
the  pressure  ratio  transducer  We  do  know  however,  that  compressor  discharge  pressure  was  chosen  by  the  engine 
manufacturer  as  one  part  of  the  pressure  ratio  function  because  this  was  not  very  susceptible  to  flow  distortion 

Fan  pressure  ratio  was  rejected  because  of  this  problem  1  can  only  assume  that  the  rotating  macluneiy  between  the 
intake  and  the  compressor  discharge  tends  to  smooth  out  any  distortion  effects  The  piessure  tapping  point  in  the 
engine  is  a  static  piessure  sensor  on  the  outside  of  the  discharge  annulus,  but  I  cannot  be  moie  specific  than  that 
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A  COMBINED  PARALLEL-DIGITAL  AND  PULSE-DURATION 
MODULATED  FUEL  METERING  SYSTEM 


H.  Holzem 

Pierburg  Luftfahrtgerate  Union 
D-4040  Neuss,  Postfach  989,  W-Germany 


1.  Summary 

Control  units  for  gas  turbine  engines  in  use  today  or  in  the  future,  work  according  to 
control  algorithms  which  strive  for  the  most  accurate  metering  of  the  primary  energy 
contained  in  the  fuel.  A  fuel  metering  system  is  presented  which  can  be  controlled  paral¬ 
lel-digital  ly  by  a  computer.  This  system  seems  to  be  preferably  suited  for  small  and 
medium  size  engines.  High  accuracy  requirements  coupled  with  both  robust  and  simple  con¬ 
struction  can  be  met.  The  design  and  functional  description  is  supplemented  by  the  labo¬ 
ratory  test  results  so  far  achieved. 


2.  Introduction 


The  common  electro-mechanical  metering  units,  which  are  working  on  the  principle  of  an 
analog  or  an  incremental  variation  of  a  metering  area  are  complex  in  comparison  with  the 
corresponding  units  used  in  purely  mechanical  controls.  Close  fits  between  piston  and 
sleeve,  as  well  as  an  accurate  profile  configuration  of  the  metering  area  are  still 
prevailing.  In  addition,  the  following  extra  components  are  provided: 

Electro-mechanical  converters  with  torque  motor  or  stepper  motor  to  drive  the  sli¬ 
ding  valve. 

Electro-mechar.ical  feedback  for  the  metering  area,  in  which  case  dual  redundancy  or 
corresponding  monitoring  is  desired. 


With  a  similar  metering  principle  applied  and  with  the  same  exacting  requirements  with 
regard  to  functional  control  accuracy  as  required  for  a  large  engine,  a  lower  rated 
engine  would  practically  require  a  scaled-down  version  of  such  a  metering  unit.  When 
disregarding  the  material  expense,  the  cost  would  hardly  be  lower  than  that  of  the  larger 
version,  and  the  reliability  would  of  course  be  inferior  due  to  the  miniaturisation  of 
the  mechanical  components. 

Due  to  this  circumstance,  other  engineering  solutions  have  to  be  found,  in  particular 
solutions  which  do  not  merely  represent  a  scaled-down  version. 


3 .  Description  of  the  Metering  Principle 


3 . 1  Metering  by  Means  of  On-Off  Valves 

For  the  purpose  of  controlling  a  mass  flow  in  industrial  process  engineering,  several 
on-off  valves  having  different  metering  areas  are  connected  in  parallel. 

All  depending  on  the  demanded  flow  rate,  some  of  the  valves  may  be  kept  open  or  closed. 
The  metering  areas  are  graded  to  the  binary  system.  As  may  be  seen  from  Fig  1,  the  diffe¬ 
rence  between  demanded  and  actual  flow  is  12.5%  of  the  maximum  value  when  using  three 
valves  only.  This  difference  is  unacceptably  large.  To  reduce  this  difference  to  a  value 
adequate  to  gas  turbine  engines  nine  valves  equivalent  to  the  resolution  512  would  be 
required.  The  disadvantage  of  this  arrangement  may  not  only  be  seen  in  the  large  number 
of  valves  that  is  to  say  structural  weight,  cost,  energy  consumption,  but  also  in  the 
problem  caused  by  the  very  small  area  of  the  valve  having  the  lowest  binary  gradation. 

Nevertheless,  on-off  valves  offer  inherent  advantages  compared  with  proportional  valves: 

They  have  but  two  exactly  defined  flow  values,  e.g.  zero  and  maximum. 

They  do  not  require  a  displacement  feedback. 

They  are  of  a  more  simple  design,  considerably  cheaper  and  much  more  reliable,  so 
that  also  the  application  of  several  valves  is  acceptable. 

Their  switching  times  are  so  short,  that  the  dynamics  of  the  metering  operation  are 
only  dependent  on  the  hydraulic  conditions  of  the  manifold  system. 


A  different  way  of  varying  the  metering  area  is  shown  in  Fig.  2.  The  serrated  line  de¬ 
picts  the  residual  flow  which  in  Fig.  1  is  still  missing  to  achieve  a  continuous  metering 
characteristic.  A  valve  is  opened  and  closed  at  a  constant  sequence,  with  the  opening 
time  being  changed  at  the  expense  of  the  closing  time  so  that  the  total  of  the  two  times 
remains  unchanged.  This  so-called  pulse-duration  modulated  (PDM)  controlling  of  a  valve 
allows  for  a  proportional  timing  of  the  mean  time  value  of  the  fuel  flow. 

Fuel  injection  systems  of  motor  vehicles  are  working  in  a  similar  way.  It  is,  however, 
quite  problematic  to  chop  fuel  flow  rates  of  a  magnitude  as  is  required  for  gas  turbine 
engines.  Besides,  the  amount  of  electric  energy  required  by  such  a  valve,  as  well  as  the 
weight  of  the  valve  itself,  would  be  disproportionally  high.  In  addition,  linear  modula¬ 
tion  of  a  solenoid  valve  can,  in  practice,  only  be  achieved  within  a  limited  flow  range. 
An  explanation  of  these  circumstances  is  given  in  Fig.  3:  Due  to  its  limited  switching 
speed  an  on-offvalve  requires  a  certain  settling  time  (Ts)  for  safe  opening  and  closing. 
Therefore,  Ts  has  to  be  subtracted  from  one  period  T  in  order  to  reach  the  longest  permis¬ 
sible  effective  opening  time  up  to  which  a  linear  modulation  of  the  valve  is  still  pos¬ 
sible.  The  shortest  possible  effective  opening  time  is  approximately  equal  to  Ts.  From 
this,  one  may  calculate  the  metering  range  R  as  follows 


High  performance  valves  which,  particularly  for  pulse-duration  modulation,  are  provided 
with  a  fast  switching  property,  have  a  settling  time  of  Ts  =  1  to  1,5  ms.  At  a  modulation 
frequency  of  50  Hz  the  remaining  metering  range  would  nevertheless  be  R  =  12,  whereas  at 
100  Hz  the  range  would  reduce  to  5,6.  But  even  a  metering  range  of  12  is  too  narrow  for  a 
gas  turbine  engine,  so  that  at  this  point  pulse-duration  modulation  as  a  sole  means  of 
metering  has  found  its  natural  limitation.  Frequencies  of  much  less  than  50  Hz  cannot  be 
applied  for  reasons  still  to  be  explained  (Refer  to  5.1).  It  is  in  fact  only  by  the 
combined  employment  of  the  two  metering  methods  that  the  disadvantages  inherent  to  each 
individual  method  may  be  largely  eliminated  (refer  to  Fig.  4). 

In  the  example  explained  here,  altogether  four  valves  are  used  which,  thanks  to  appro¬ 
priate  signal  processing,  are  able  to  achieve  a  wide  linear  metering  range  with  a  satis¬ 
factory  resolution  capability.  It  may  furthermore  be  seen  from  this  example  that  a  maxi¬ 
mum  flow  of  the  cycle  valve  VI  must  be  higher  than  the  flow  of  the  lowest  binary  graded 
valve  V2  due  to  the  limited  modulation  range  (chosen  R  =  6).  In  this  case  the  difference 
is  2.5%  of  full  scale  and  the  values  of  both  coordinates  has  increased  by  that  amount. 


3.2  Signal  Processing 

Fig.  5  shows  the  simplified  circuitry  of  a  metering  system  design  having  four  on-off  sole¬ 
noid  valves,  Vl  through  V4,  connected  in  parallel.  The  pressure  differential  aP  across 
the  valves  is  kept  constant  by  a  pressure  control  of  the  usual  design.  The  input  signal- 
Qdemand  is  coming  from  the  engine  control  system  and  is  converted  into  the  fuel  flow 
Qact  to  the  burner  as  follows:  The  binary  coded  analog-digital  converter  forms  the  control 
signals  02,  03,  04  for  the  basic  flow  valves  V2,  V3,  V4.  The  electric  analog  flow  values 
Q1  through  Q4  of  the  individual  valves  are  stored  in  a  calibration  device  by  means  of 
four  potentiometers.  Independent  of  the  signal  levels  (either  high  or  low  level)  01 
through  04,  the  switch  unit  transfers  the  calibrated  flow  values  Q1  through  Q4  of  the 
opened  valves  to  the  summation  point  (feedback).  Therefore,  the  signal  Qact.electr. 
represents  the  electrical  analogy  of  the  fuel  flow.  Manufacturing  tolerances  affecting 
the  flow  rates  of  the  valves  may,  within  certain  limits,  be  compensated  by  the  electrical 
calibration  device.  The  difference  Qdemand  minus  Qact.electr.  acts  on  an  integrator 
which,  in  turn,  controls  a  pulse-duration  modulation  circuit  supplying  the  control  pulses 
for  the  cycle  valve  VI. 

The  analog-digital  converter  must,  in  addition,  generate  switching  hysteresises  H  (Fig.  4) 
to  prevent  a  slight  unsteadiness  in  the  desired  value,  i.e.  around  point  A,  from  causing 
an  uninterrupted  switch-over  of  the  basic  flow  valves  V2,  V3,  V4.  The  hysteresis  is  in 
the  order  of  a  few  percent  and  is  taken  into  account  by  the  pulse-duration  modulated 
valve  VI  due  to  its  modulation  reserves. 

Fig.  6  illustrates  valve  position  and  the  course  of  control  voltage  Uc  at  steps  of  Qdemand 
based  on  the  above  mentioned  valve  flow  gradation.  At  Qdemand  of  18%,  12.5%  of  the  full 
scale  flow  rate  are  metered  by  valve  V2.  The  control  voltage  Uc,  the  intersections  of 
which  with  the  auxiliary  delta  voltage  Ud  are  generating  the  control  pulses  for  valve  VI, 
changes  until  the  me?n  time  value  of  the  flow  from  VI  corresponds  with  the  remaining 
5.5%. 

At  a  small  input  step  of  the  demanded  value  to,  i.e.  21%,  only  the  modulation  ratio  will 
be  changing,  whereas  at  a  big  input  step  to  e.g.  89%  also  the  basic  flow  valves  will  be 
switched  on. 

The  rate  of  the  integrator  is  chosen  such,  that  in  the  extreme  case,  when  valve  1  is 
fully  opened  or  fully  closed,  the  trace  of  Ur  will  be  flattened  a  little  more  than  that 
of  Ud,  since  otherwise  there  would  be  several  intersections  within  one  period,  which 
would  cause  undesired  additional  cycles.  With  the  regulator  adjusted  in  such  a  way,  each 
desired  flow  value  may  be  electrically  set  within  one  cycle  period. 
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4 .  Hydromechanical  Part 

A  schematic  diag^amme  of  the  hydromechanical  part  of  the  metering  unit  is  shown  in  Fig.  7. 
At  this  design  configuration,  the  solenoid  valves  VI  (pulse-duration  modulated)  and  V2 
(binary)  are  directly  metering  part  of  the  fuel  flow,  whereas  valves  V3  and  V4  (binary) 
are  servo-flow  actuated  by  one  magnetic  pilot  valve  each.  The  effective  direction  of  all 
valves  has  been  chosen  so  that  they  open  when  being  energized.  The  servo  pressure  diffe¬ 
rential  P2-P4  across  the  pilot  valves  is  controlled  in  such  a  way  that  it  may  be  kept 
constant  to  values  which  are  compatible  with  the  valves.  (P4  «  P2-2  AP).  During  the 

switching  operations  the  servo  flow  is  employed  for  a  short  duration  of  time  only,  since 
at  opened  pilot  valves  the  pertaining  balls  are  contacting  the  left-hand  stops,  thereby 
excerting  a  sealing  action.  When  closing  the  pilot  valves,  the  balls  occupy  their  respec¬ 
tive  valve  seat  at  their  right-hand  side.  During  this  sequence  fuel  passes  through  the 
annular  gaps  between  ball  and  guiding  sleeve  into  the  chamber  arranged  at  the  left-hand 
side  of  the  ball. 

The  solenoid  valve  of  this  first  breadboard  unit  originates  from  an  automotive  injection 
system  and  has  been  modified  for  the  present  application. 
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Functional  Behaviour,  some  Data 


5.1  Flow  Pulsations  and  Metering  Range 

In  Fig.  8  the  relative  share  r  of  the  pulsating  flow  is  plotted  versus  the  mean  flow  Qm, 
on  the  basis  of  the  four-valve-arrangement. 

The  particular  trace  of  the  curve  may  be  accounted  for  by  the  superposition  of  two  effects. 
At  the  relative  maximums  of  the  pulsations,  that  means,  at  the  points  where  the  largest 
absolute  flow  change  A  Q  occurs,  a  modulation  ratio  of  1:1  (50%  modulation)  is  prevailing. 
Above  or  below  that  modulation  ratio,  the  absolute  flow  change  deminishes.  In  conformity 
with  the  definition  of  r  the  pulsations  at  lower  flows  are  higher  rated  accordingly,  so 
that  a  hyperbolic  function  is  created. 

As  may  furthermore  be  seen  from  Fig.  8,  the  pulsations  are  dependent  on  the  relation 
between  the  hydraulic  time  constant  of  the  metering  unit  and  the  cycle  duration  T  of 
the  modulation  frequency.  The  hydraulic  time  constant  is  primarily  determined  by  the 
storage .volume  of  a  piston  or  a  diaphragm  in  the  pressuie  differential  control,  but  also 
by  the  diameter  and  the  length  of  the  burner  line  and  by  the  flowcharacteristic  of  the 
burner.  The  pulsations  are  measured  directly  at  the  burner.  Since  pressure  differential 
controls  fitted  with  metering  units,  as  used  for  small  gas  turbine  application  are,  in 
particular,  operating  without  servo  energy,  they  require  diaphragms  (or  pistons)  which 
have  a  relatively  high  stroke  volume.  This  means  first  of  all  that  irrespective  of  the 
design  of  the  metering  unit  employed,  the  time  constant  T  for  the  step  response  of  the 
fuel  flow  may  hardly  be  expected  to  be  less  than  80ms.  This  also  applies  to  the  described 
case.  When  choosing  a  modulation  frequency  of  50  Hz  (T  =  20ms),  XI T  will  be  4. 

It  may  be  seen,  that  at  5%  of  maximum  mean  flow  Qm,  9%  of  the  flow  pulsations  are  still 
prevailing  which  are  causing  a  corresponding  fluctuation  of  the  flame  temperature  in  the 
combustion  chamber.  Relevant  investigations  have  still  to  be  undertaken.  It  can  be  said 
already  now  that  the  temperature  at  the  surface  of  the  turbine  blades  will  only  be  affec¬ 
ted  by  a  small  residual  amount  of  the  pulsations.  As  a  result  of  the  pneumatic  storage 
capacity  of  the  combustion  chamber  and  of  part  of  the  compressor,  the  pressure  pulsations 
to  be  expected  will  be  additionally  smoothed.  Besides,  the  load  limit  of  g-s  turbine 
engine  is  not  reached  at  5%  of  the  maximum  flow.  In  most  cases  the  total  metering  range 
of  small  to  medium  size  gas  turbine  engines  does  not  exceed  20. 

The  pulsating  share  may  also  be  reduced  by  providing  for  a  fixed  minimum  flow  by-pass  of 
e.g.  2.5%  (refer  to  broken  line  of  curve).  In  this  case  a  certain  disadvantage  may, 
however,  be  seen  in  the  circumstance  that  in  the  lower  part  of  the  flow  range  the  pulse- 
duration  modulated  valve  would  have  to  be  continuously  modulated  down  to  zero  flow,  which 
would  entail  a  linearity  loss.  This  may  be  avoided  by  starting  the  metering  range  only 
above  5%  of  Qm. 

A  further  possibility  to  reduce  the  pulsations  at  low  flows  would  be  to  modulate  in  the 
push-pull  mode  valves  1  and  2  at  less  than  15%  of  Qm. 
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This  would  cut  the  cycle  duration  to  10  ms,  so  that  in  this  case  the  more  favourable 
dotted  curve  would  apply  for  T /T  =  8.  If  the  original  linearity  shall  be  maintained, 
the  metering  range  has  to  be  reduced,  since  the  total  of  the  lowest  permissible  flows  of 
valves  1  and  2  are  now  determining  the  minimum  flow  of  the  metering  unit. 

The  additional  pulsations  which  occur  when  switching  on  the  basic  flow  valves  are  negli¬ 
gibly  low.  The  total  switching  time  of  the  ball  valves  plus  pilot  valves  is  in  the  order 
of  3  to  4  ms.  The  dissymmetry  of  the  switcning  behaviour  does  not  exceed  1  ms.  If  e.g. 
valve  V4  is  in  the  fully  opened  position  1  ms  later  than  V3  or  V2  have  switched  to  the 
closed  position,  the  flow  would  drop  to  the  zero  flow  rate  (refer  to  Fig.  4,  e.g.  Point  A) 
for  a  duration  of  1  ms,  disregarding  the  hydraulic  inertia.  With  due  regard  to  the  time 
constants  of  the  fuel  lines  and  to  the  storage  volume  of  the  pressure  differential  con¬ 
trol,  it  can  be  said  that  the  actual  flow  drop  3  in  the  order  of  1%. 


/-q 


5 . 2  Accuracy 

With  four  valves  employed,  the  linearity  deviation  is  less  than  _+  2%  of  reading  over  a 
flow  range  of  80:1.  At  the  beginning  of  the  investigations,  type  and  temperature  of  the 
fuels  were  kept  constant.  For  the  rest,  the  same  problems  with  regard  to  viscosity  and 
density  are  present  than  are  experienced  at  the  common  continuous  metering  systems. 

In  both  cases  the  accuracy  is  in  addition,  influenced  by  the  quality  of  the  pressure 
differential  control.  Simple  controls  are  keeping  the  pressure  differential  constant 
within  +  4  to  5%.  The  effect  of  this  deviation  on  the  flow  rate  being  approximately  half 
of  that  percentage.  During  the  investigations  so  far  performed,  the  deviation  of  the 
pressure  differential  control  was  eliminated  in  order  to  be  able  to  determine  the  accu¬ 
racy  which  originates  alone  from  the  behaviour  of  the  on-off  valves. 


5.3  Consumption  of  Electrical  Power 

On  principle,  fast  acting  on-off  valves  require  a  comparatively  high  controlling  power. 
By  appropriate  measures,  only  a  short-time  current  peak  is  applied  to  the  valve,  whereas 
but  a  low  current  is  required  to  keep  the  basic  flow  valves  open.  The  mean  power  consump¬ 
tion  of  the  four  valves  is  altogether  lSWatt  with  the  controlling  electronics  included. 
This  value  still  remains  within  reasonable  limits  at  a  maximum  flow  rate  of  nearly 
300  kg/hour. 


6 .  Conclusion 

According  to  the  first  investigation  results  obtained  on  a  breadboard  mecering  unit,  the 
accuracy  which  on  present  metering  systems  can  only  be  achieved  by  employing  a  sophisti¬ 
cated  feedback,  can  now  apparently  be  reached  with  more  simple  means.  The  combination  of 
pulse-duration  modulated  valves  and  binary  graded  valves  does,  however,  cause  residual 
flow  pulsations. 

To  obtain  detailed  knowledge  on  the  affect  of  such  pulsations,  relevant  combustion  chamber 
and  engine  tests  have  still  to  be  undertaken.  The  described  method  of  controlling  the 
valves  is,  in  the  first  instance,  suitable  for  analog  flow  values  and  has  proved  to  be 
successful  for  basic  investigations. 

It  is  also  intended  to  control  the  valves  directly  by  a  digital  computer. 

Even  if  no  weight  reduction  is  expected  from  the  described  metering  unit  it  can  neverthe¬ 
less  be  said  that  the  production  cost  will  be  lower  thanks  to  the  more  simple  design.  An 
improved  reliability  is  also  to  be  expected. 
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DISCUSSION 


D.M.Griffiths,  UK 

What  is  the  perturbation  in  fuel  flow  when  V4,  which  switches  one  half  the  total  flow,  changes  state? 

Author’s  Reply 

(a)  If  for  instance  V4  is  closed,  valve  V2  and  V3  will  simultaneously  open.  The  degree  of  modulation  of  VI  will 
change  also  (refer  to  P'/int  A  in  Figure  4).  It  is  in  particular  due  to  the  special  kind  of  control  employed  that 
large  pe-‘:rbations,  as  are  for  instance  still  occurring  in  Figure  1,  will  be  avoided. 

(b)  Though  perturbations  are  still  present  during  the  transient  time,  they  are  only  in  the  order  of  1%,  since  the 
transient  time  takes  just  a  few  milliseconds  (approx.  4-6  ms  at  V3  and  V4,  and  approximately  1.5  ms  at  V2 
and  V3),  and  since  the  flow  spikes  are  intensely  smoothed  due  to  the  hydraulic  inertia  of  the  fuel  manifold 

M.J.Joby,  UK 

The  smallest  valve  in  the  system  in  required  to  oscillate  rapidly  what  life  can  be  expected  with  this  device,  and  are 
dirt  and  magnetic  debris  likely  to  cause  problems? 

Author’s  Reply 

During  the  breadboard  tests  carried  out  so  far,  Bosch  solenoid  valves  (for  fuel  injection  on  Otfo  engines)  have  been 
used  for  VI  and  V2,  and  pilot  valves  have  beer,  used  for  V3  and  V4. 

Irrespective  of  the  poor  lubricating  properties  of  gasoline,  such  valves  (refer  to  Figure  7)  have  not  shown  any  wear, 
not  even  after  1 50,000  driven  kilometers  (approx.  3  000  hours).  The  valves  are  provided  with  strainers  to  keep  away 
dirt  and  metal  particles  which  have  passed  through  the  working  filter  fitted  at  a  further  upstream  location  Magnetic 
debris  having  a  particle  size  of  <l0pm  does  not  accumulate  in  the  valves  used.  This  may  obviously  be  attributed  to 
the  frequent  and  abrupt  armature  movements,  to  the  fact  that  the  valves  arc  flushed  with  fuel  and  last  bu*  not 
least,  to  the  vibration  imposed  from  the  outside  (in  the  case  of  the  Otto  engine)  For  the  rest,  it  is  also  conceivable 
that  minute  particles,  as  far  as  they  are  not  stainless,  ar  -veloping  a  lubricating  property  in  conjunction  with  the 
fuu  Gas  turbine  application  design  techniques  may  ab  oe  applied,  which  lead  to  an  increased  reliability,  such  as 
for  instance  tne  frictionless  suspension  of  the  magnet  armature  by  means  of  so  called  spiders. 
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RESUME 


La  disponibilite  de  circuits  a  haut  niveau  d'iritegration  offre  au  concepteur  de  nouvelles  possibilities 
pour  definir  rationnellement  des  automates  num't lques  intdgres  dans  le  systeme  de  regulation  des  propulseurs. 

L’architecture  de  ces  automates  est  definie  en  preriant  simultanement  en  oompte  : 

-  les  specifications  fonctionnelles,. 

-  les  specifications  operationnelles  qui  portent  notamment  sur  la  fiabilite  et  sur  la  secunte  des 
missions, 

-  les  contraintes  technologiques  imposees  par  un  environnement  agressif. 

1.  -  Introduction 


Les  performances  toujours  plus  grandes  exigees  des  turboreacteurs  -poids,.  poussSe,  consommation,  pilota 
bilite,  sfcurite,  disponibilite-  dans  de  tres  vastes  dnrnaines  de  vol  impliquen*  une  sophistication  sans  cesse 
croissante  de  leur  systeme  de  regulation.  Des  lors,  les  motoristes  sont  conduits  a  associer  des  regulateurs 
hydromecamques  et  electroniques  en  repartissant  l'autonte  relative  de  ces  deux  techniques  en  fonction  des 
objectifs  A  atteindre,  qu’ils  soient  fonctionnels,  operationnels  ou  economiques. 

L’evolution  spectaculaire  de  la  densite  des  circuits  integres  permet  de  disposer  de  micro-mim-calcula- 
teurs  dans  un  boitier  de  10  cm3  ou  de  realiser  des  unites  de  traitement  a  tres  hautes  performances  en  asso- 
ciant  une  douzaine  de  circuits  LSI.  Dans  ces  conditions,  nous  pouvons  realiser  des  regulateurs  utilisant  au 
mieux  les  ressources  matenelles  et  logicielles. 

L'analyso  du  processus  de  regulation,  la  definition  claire  des  objectifs  de  sOrete  de  fonctionnement, 
la  prise  en  compte  des  contraintes  imposees  par  1 ’onvironnt  rnent  parmettent  au  concepteur  de  definir  methodi- 
quement  des  structures  particul lerement  adapters  a  la  regulation  des  turbomachines. 

2.  -  Definition  des  structures  fonctionnelles  d'un  rEgulateur  numErique 

2.1. -  ANALYSE  DES  SPECIFICATIONS  FONCTIONNELLES 

Les  specifications  fonctionnelles  po: tent  sur  ; 

-  1 ’acquisition  des  pararnetros  de  la  regulation, 

-  1 ’execution  des  taches  cor  respondent  aux  differentes  phases  de  la  regulation, 

-  1 'actuation,, 

-  le  comportement  dynamique. 

2.1.1.  -  Acquisition  des  parametres  de  la  regulation 

le  nombre  de  paramfetres  '  acqucrir  depend  des  lots  de  regulation  et  des  niveaux  de  redondarire 
retenus.  Une  configuration  typique  est  donnee  figure  1. 

Le  choix  des  capteurs  adaptes  a  un  traitement  numenquu  est  relativement  limits  vOtripte  tenu  des 
contraintes  de  fiabilite  (environnement  physiqco),  de  secu'ite  (testaoi litel  et  de  facilite  d ’ isolement 
galvanique. 

2. 1.1.1.  -  Mesures  de  gosition 

Le.  capeeurs  electron agnetiques,  f oricticnnant  un  ratiurnetre  avec  des  frequences  porteuses  comprise 
entre  4(10  et  4000  c/s.,  sont  bien  adaptes  aux  problemes  posAs. 

En  fonLtion  du  nombre  de  Lapteurs  et  dt  s  bandes  pussantes  necessanes,  r  jus  utilisons  trois  modes 
ae  traitei.ient  : 

-  1'approche  classique  de  la  -igure  2.1.  avpc  un  module  de  conditiunnempnt  oar  voie, 

-  1 ’ echanti 1 lonnage  direct  du  signal  a'ternatif  associp  a  un  circuit  dp  calrul  et  de  filtrsge 
( f igure  2  .2  . ) , 

-  le  multiplexagf  d’un  demodulateui  (figure  2.3.)  un  effectuant  1 ’ acquisit ion  en  parailele  uctr  le 
cai.ul  et  en  conpe  isant  1  efret  dea  retards  par  des  reseaux  ccirecteuis  appropiies. 

2.1.1.  .2.  -  Mesures_de_vitesse_de_rotation 

La  vltossr  de  rotation  est  I  epi  usentet  pai  urm 
suit  par  Jcs  alter  f'dtt.r  s.  La  resale  des  ctutb  su.ressif c 
:  '  ll  riaf  Dur  a„  cornpinmis  pul  l' demuti  e-f  I  uquer  .  e-"L  tre  . 

2. 1.1. 3.  -  Au t res _ informations 

L 1  jcq  .  is  1 1  ior  *e  .ignex  .Tti'iub  m  :  j-f'ib  as  dj  paiagrapre  7,1... 2.  pa:  1; 


frequence  delivrer-  suit  par  des  capteuls  lriductifs 
I’on  c  ”  ptuur  ut  I’un  filtrapt  numu:  ldJC  p>:met 
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2.1.2.  -  Actuation 

L 1  Elaboration  des  signaux  de  commande  16  a  8  commandes  continues,  8  a  10  commandes  tout  ou  rien)  ne 
pose  pas  de  problEme  de  choix  si  nous  nous  imposons  l’une  des  conditions  suivantes  : 

maintien  des  sorties  a  la  valeur  prEcEdente  en  cas  de  panne  autodEtectEe, 

-  convnutation  a  une  valeur  predEterminEe  par  une  commande  pilots. 

2.1.3.  -  Les  taches  correspondant  aux  differentes  phases  de  ia  regulation 

2. 1.3.1.  -  Regr§sentation_du_fonctionnement 

Une  propriEte  fondamentale  du  processus  de  rEgulation  est  que  l'etat  du  moteur  dEpend  essentiel- 
lement  de  l'Etat  prEcEdent  et  que  les  transitions  possibles  entre  Stats  sont  en  nombre  fini  et  bien  dSterminS 
(figure  3) . 


'.a  prise  en  compte  de  la  rSpetition  des  phases  de  rEgulation  sec  et/ou  post-combustion  a  chaque 
periode  d ' Schantillonnage  et  de  leurs  specifications  particulieres  permet  de  completer  le  rSseau  initial  et 
d'obtenir  1 'organigramme  gEnSral  de  la  figure  4. 

Chacune  des  transitions  du  graphe  de  la  figure  3  peut  etre  reprSsentee  par  des  graphes  partiels 
qui  conduiront  E  des  organigrammes  detaillSs  :  a  titre  d'exemple,  le  fonctionnement  de  la  phase  d'allumage 
de  la  post-combustion  est  decrit  par  les  figures  5.1.,  5.2.  et  5.3. 

La  modElisation  par  rSseaux  de  Petri  du  fonctionnement  general  du  systeme  puis  1 ' Etablissement 
et  le  regroupement  de  rSseaux  partiels  facilitent  le  dialogue  entre  les  ingEnieurs  concernes  par  la  rEgula¬ 
tion,  qu'ils  soient  thermodynamiciens  ou  electroniciens,  permettent  de  detecter  les  oublis  et  de  lever  les 
ambigultes  des  spEcif ications.  conduisent  sans  difficulte  a  1 ' Etablissement  des  organigrammes.  Par  ailleurs, 
cette  modElisation  peut  rendre  systematique  1'extraction  du  parallelisme  entre  les  differentes  taches  de 
la  rEgulation  (BEO  77). 

2. 1.3. 2.  ••  Charge_de_calcul 


*§ 
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L'ensemble  des  calculs  a  effectuer  a  chaque  periode  d’echantillonnage  represents  une  charge 
Equivalents  a  1 'execution  de  500  E  2000  operations  Elementaires  de  mEmoire  r.  mEmoire. 

Cependant,  1 'analyse  des  inte-actions  entre  les  differentes  boucles  et  1 ' independence  de  certaines 
fonctions  a  l'intEneur  des  boucles,  permet  de  degager  un  degrE  de  parallelism!'  important.,  ce  qui  permet 
d'envisager  1 'utilisation  de  plusieurs  processeurs  banalises  ou  specialisEs  pour  constituer  1 'unite  de  > 

traitement. 

2.1.4.  -  Comportement  dynamique  : 

La  precision  et  la  stabilite  de  la  boucle  de  regulation  sont  liees  au  choix  de  la  periode  d'Echan- 
tillonnage. 

Nous  avons  retenu  pour  un  regulateur  electronique  a  hautes  performances  une  periode  d ' echantillon-  ; 

r.age  de  20  ms  avec  la  possibilite  d'affecter  a  des  taches  determinees  un  nombre  de  periodes  multiple  ou  plus  ; 

rarement  sous-multiple  de  la  periode  de  base.  v 

2.2.  -  PRISE  EN  COMPTE  DES  CONTRA! NTES  TECHNOi  OGiQllES  ' 

L' automate  dn  regulation  numenque  doit  assurer  les  performances  requises  dans  un  environnement 
thermique.,  vtb:  -t.  electrique  et  radio-el6ctrique  partiuulierement  sEvere  qui  limite  les  choix  des 
technologies  LSI. 

La  techno£og<i!  bipotcuAe  (TILLS)  autorise  de  trEs  bonnes  performances.,  sa  fiabilite  previsionnelle  5 

est  la  plus  prometteuse.  En  contrepartie,,  elle  demande  un  refroidissement  plus  efficace,  et  le  probleme  des  i 

microcoupures  d'alimentation  ne  peut  etre  resolu  qu’en  faisant  appel  a  des  sous-ensembles  CMOS. 


I 


La  tucluw  to  gill  CMOS,  lorsque  les  performances  sont  suffisarites.  semble  particul  xErement  hien  adaptee 
aux  applications  militaires.  L’lmmunite  au  bruit  est  excellente.  son  Evolution  en  temperature  est  stable, 
sa  consommation  statique  est  faible. 

2 

Nous  avons  eliininE  la  technologie  I  L  pour  cause  d'lmmaturitE  et  les  technologies  M0S  dynamiques  qui 
se  sont  revelees  trop  sensibles  a  haute  temperature. 

Nos  applications  actuelles  sont  done  basees  sur  les  micr oprocesseurs  : 

-  2900  :  Microprocesseur  en  tranche  de  4  bits,,  microp.  ugrammable . 

La  famille  2900  est  tres  iargement  utilises  cans  des  applications  militaires  et  spatiales. 
Les  versions  actjelles  sont  en  technologie  bipolairi  mais  de  numbreux  constructeurs  dEveloppent  des  versions 
CMOS  sur  saphir  dans  le  but  de  reduire  les  consommations  et  d'etendre  le  fonctionnement  a  des  temperatures 
tres  elevees. 

-  6100  :  Microprocesseur  12  bits  en  tecnnologie  CMOS. 

Le  logicie1  au  5100  est  compatiole  avec  celui  du  caiculateur  PGP8-7. 

-  ISC 2  :  Microprocesseur  6  cuts  en  CMOS. 

L'architecture  du  COP  tBOC  reno  particuiiErement  aisee  ia  "'ampuidtion  de  donnees. 
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2.3.  -  CHOIX  DES  STRUCTURES  FONCTIONNELLES 


Le  regulateur  eiectronique  assure  deux  fonctions  essentielles  : 

-  le  s^quencement  de  la  regulation  tant  au  niveau  global  qu’au  niveau  de  1' execution  des  t§ches 
eiementaires  (figures  3  et  4), 

-  le  traitement  des  fonctions  arithmetiques  associees. 

Les  fonctions  de  sequencement  et  de  traitement  peuvent  etre  regroupees,  on  a  alors  une  structure 
classique  de  mini-calculateur  gere  par  un  momteur  temps  reel,  ou  partagee  physiquement  entre  un  operateur 
de  commande  et  des  operateurs  banalises  ou  specifiques. 

Le  choix  entre  ces  structures  est  lie  aux  specifications  generales  de  l'application  envisagee  :  capaci- 
te  de  traitement  evolutive  ou  non,  facilite  d’introduction  des  techniques  de  surete  de  fonctionnement, 
adaptation  S  1' evolution  de  la  technologie . . . 

Les  possibilites  offertes  par  les  microprocesseurs  en  vue  de  la  realisation  de  regulateurs  eiectroniques 
sont  illustrees  par  la  description  sommaire  de  trois  ensembles  : 

1.  un  regulateur  eiectronique  type  mini-calculateur  (figure  6.1.) 

2.  un  systeme  multi-microprocesseur  (figure  6.2.) 

3.  un  regulateur  b  operateurs  (figure  6.3.) 

2.3.1.  -  Un  regulateur  eiectronique  du  type  mini-calculateur 

Ce  regulateur  est  organise  en  associant  b  un  microprocesseur  CMOS  un  operateur  arithmetique.  II 
comprend  deux  cartes  : 

1.  La  carte  interface  analogique  qui  assure  les  conversions  analogiques-numeriques  et  num6riques 
analoi  iques  ainsi  que  la  mise  en  forme  des  signaux  tout  ou  rien.  Pour  obtenir  une  configuration  materielle 
minimale,  les  voles  d' entree  et  de  sortie  sont  transferees  par  1 ’ intermedj aire  de  buffers  consideres  comme 
des  adresses  memoire. 

2.  La  carte  processeur  (figure  7)  est  constituee  par  : 

-  un  mlr.-vorocesseur  COSMAC  (8  bits), 

-  un  mul.iplieur  16  bits  du  type  serie-parallele  realise  en  micro-electronique  hydride,, 

-  une  memoire  programme  de  4  K  octets, 

-  une  memoirs  de  travail  de  1  K  octet. 

Ce  processeur  est  capable  d'executer  en  5  ms  environ  1’ensemble  des  traitements  d'un  correcteur 
numerique  simple  realisant  : 

-  1 'acquisition  de  4  voles  analogiques,. 

-  le  calcul  de  3  generateurs  de  fonction, 

-  la  commande  de  2  boucles  de  courant  en  mode  proportionnel  et  integral, 

-  la  commande  de  3  voles  analogiques  et  de  5  voies  tout  ou  rien. 

L'ex^cution  du  programme  est  contr616e  par  un  micro-moniteur  ce  qui  permet  de  programmer  leu  dif- 
ffirentes  tSches  de  la  regulation  comme  des  blocs  independents  et  d'effectuer  p§riodiquement  des  tests  de 
bon  fonctionnement  (autotest  h  la  mise  sous  tension,  calcul  de  vraisemblance. . . ) . 

2.3.2.  -  Un  regulateur  multi -processeur 

Un  regulateur  constitue  par  un  ensemble  d'unites  fonctionnelles  banalis6es  capables  d’executer 
plusieurs  traitements  simultan6s  est  particulierement  attractif.  Une  telle  structure  permet  en  effet  : 

-  1 'augmentation  progressive  de  la  capacite  de  traitement, 

-  la  reconfiguration  du  systeme  en  cas  de  panne  detectee, 

-  la  standardisation  de  sous-ensembles  realises  avec  des  micro-calculateurs  fiables  et  relativement 
peu  onereux. 

Par  ailleurs,  le  controle  reciproqus  des  diverses  unites  ameliore  l'efficacite  des  autotests. 

La  modeiisation  du  processus  de  regulation  par  reseau  de  Petri  et  1 ' utilisation  des  programmes 
d'ordonnancement  permettent  de  mettre  en  evidence  le  degre  de  paralieiisme  et  d'utiliser  au  mieux  les  ressour- 
ces  disponibles. 

Appliquee  a  la  regulation  en  mode  post-combustion  d'un  turboreacteur  simple  corps  double  flux,  on 
obtient  les  gains  de  temps  d'execution  representes  figure  8. 

L'organisation  presentee  figure  9  conduit  a  des  taux  d’occupation  de  70  %,  85  56  %,  63  %  de 

chacun  des  4  processeurs. 

En  fonction  des  cnteres  representes  figure  10,,  nous  avons  reteuu  pour  un  systeme  de  regulation 
complexe  la  configuration  suivante  : 

-  controle  centralise  par  processeur  maitre,, 

-  communications  mdirectes  d'atees, 

-  bus  commun. 

Le  processeur  maitre  est  charge  de  gerer  tous  les  echanges  ir.terprocesstjrs  et  de  reconf ig'.rer  les 
modules  esclaves  en  cas  oe  panne  ;  j'  est  equips  d'une  horloge  'amps  reel. 
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Le  nombre  de  liaisons  de  synchronisation  entre  les  processeurs  Etant  assez  faible,  les  cownunications 
entre  asclaves  transitent  par  le  maitre  qui  peut  alors  les  verifier. 

Le  comportement  du  processus  et  le  temps  requis  pour  1’ execution  d’une  t§che  sont  parfaitement 
determines  (organisation  statique  du  systeme  et  instructions  a  temps  constant).  Dans  ces  conditions,  l'alloca- 
tton  du  bus  est  faite  par  le  maitre  3  des  instants  precis,  ce  qui  permet  un  contrdle  supplEmentaire  et  rend 
facile  1 ’ Etablissement  des  protocoles  de  communication. 

La  mise  en  oeuvre  d’une  maquette  de  demonstration  n’a  pas  posE  de  probleme  particulier.  La  configu¬ 
ration  matErielle  de  1 ’ensemble  de  traitement  est  relativement  reduite  :  4  microprocesseurs,  49  boitiers 
24  broches,  56  boitiers  16  broches. 

2.3.3.  -  Un  regulateur  3  operateurs 

ASMARA  (Automate  Sur  et  Modulaire  Adapts  aux  Regulations  Avioniques)  a  etE  dEveloppE  par  le  LAAS 
dans  le  cadre  des  contrats  OKME/ELECMA  et  ELECMA/LAAS. 

Sa  structure  est  definie  par  affinements  successifs  en  prenant  en  compte  simultanEment  ou  sEquentiel- 
lement  les  contramtes  et  les  objectifs  : 

-  Evolution  vers  un  regulateur  a  pleine  autontE,  ce  qui  implique  la  capacite  d ’  introduction  des 
techniques  d’obtention  de  la  surete  de  fonctionnement, 

-  consommation  faible  3  bas  regime  moteur  de  fagon  a  assurer  la  regulation  du  rallumage  en  vol  dans 
une  configuration  ou  la  generation  Electnque  autonome  a  une  puissance  limitEe, 

-  fonctionnement  a  parformances  rEduites  en  mode  secours, 

-  grande  capacite  de  traitement, 

-  faible  dissipation  thermique  de  fagon  a  limiter  le  dimensionnement  de  la  source  de  refroidissemerit 
de  1 ’automate  montE  sur  moteur, 

-  tolerance  aux  microcoupures  de  1 ’alimentation. 

II  en  resulte  le  schema  synoptique  de  la  figure  11. 

Le  bloc,  de  conmande  a  une  structure  monoprocesseur  realises  autour  d’un  microprocesseur  CMOS  IM  6100 
a  faible  consommation.  Sa  capacite  de  traitement  est  suffisante  pour  assurer  le  sequencement  de  la  regulation 
complete  et  le  traitement  des  modes  rallumage  vol  et  secours  Electronic  le. 

Le  bloc  de.  caluil  comprend  un  processeur  16  bits  et  une  mEmoire  programme.  L 1  utilisation  d’un  micro- 

processeur  bipolaire  en  tranches  fonctionnant  avec  un  cycle  d’horloge  de  250  ns  d’une  part,  le  gain  specta- 
culaire  obtenu  par  les  techniques  de  microprogrammation  d’autre  part,  le  rendent  particuliEremert  performant. 
Notons  qu’un  champ  du  microsEquenceur  est  reserve  a  la  commande  d’un  multiplieur  rapide  ce  qui  permettrait  si 
necessaire  de  ramener  le  temps  d’execution  d’une  multiplication  a  2  us. 

La  mise  hors  tension  du  bloc  de  calcul  pendant  environ  les  3/4  de  la  penode  d’echantillonnage,  sous 

contru  e  du  bloc  de  commande,  permet  de  limiter  la  dissipation  thermique  a  6  W. 

La  mimoifie  de  iauvetage.  L’energie  stocKee  dans  un  condensateur  de  100  uF  est  suffisante  pour  sauve- 
garder  pendant  100  ms,  en  cas  de  coupure  d ’ alimentation,  le  contenu  d’une  mEmoire  CMOS  en  mode  inactif. 
Cependant,  les  operations  de  sauvetage  Etant  toujours  penlleuses,  la  mEmoire  est  scindee  en  deux  blocs  aux 
roles  symetriques  :  un  bloc  contient  les  informations  relatives  a  la  penode  d’echantillonnage  precedente, 
l’autre  bloc  permet  de  m&noriser  les  informations  elaborees  pendant  la  penode  en  cours.  Les  roles  de  chacun 
de  ces  blocs  sont  intervertis  sous  controle  du  sequenceur. 

Lei  blod  d'acqiui ctton  eX  d’ actuation  ont  un  fonctionnement  autonome  sous  controle  d’un  microproces¬ 
seur  local  chargE  notamment  de  regler  les  conflirs  d’acces. 

lei  2x0x40116.  L ’utilisation  de  liaisons  du  type  scrie  parallele  permet  de  rEduire  1  ’  interconnexion 
et  de  faciliter  1 ’ introduction  des  techniques  de  surete  de  fonctionnement. 

•2.4.  -  L ’ORGANISATION  LOGIC IELLE  O’ UN  REGULATEUR 


Le  comportement  detenniniste  du  moteur  vis-a-vis  de  sa  regulation  permet  de  mettre  en  oeuvre  un 
logiciel  sur  de  par  sa  simplicite  et  son  observability. 

2.4.1.  -  Le  momteur  cemps  reel 

Le  nombre  d’etats  et  de  transitions  entre  ces  etats  etant  parfaitement  determine,  1 ’enchainernent  des 
taches  est  du  type  statique  :  lecture  de  tables  correspondant  a  la  configuration  du  systeme  et  a  l’Etat  de 
1’horloge  temps  reel. 

La  structure  geneiaie  represpntee  figure  12  fait  an;  aiaitre  troic  groupes  de  functions  qui  ont  la 
meme  organisation  : 

-  le  groupe  de  gestion  des  ressourc&s  mater leilos  A, 
le  groupe  regulatior  du  processus  R, 

-  le  groupe  developpei mnt  0. 

Les  groupes  A  et  R  fonstmnnert  cn  temps  i  ^e1 ,  lams  interactions  se  borrient  a  des  transfects 
d’arguments.  Le  groupe  D  primer  a  l’cpeiate.,1  d  ’  mt  a  \  >:mr  ir  phase  de  dt’veloppimont  sui  les  groupes  A  et  R. 
Son  fonctionnement  en  temps  reel  r  ’est  pas  autorise  prur  1=3  raison  du  sec, rite. 


x  Latcratoifc  1  ’Autoratique  et  n’Aojlyse  des  Sy.-’trrr 

Lorranae  jc  process.!  j  (ace  -r  rncrcprccessc.-i  -  et 
Cor  1 1 at  DRME  N°  74/431 


d ’ i  narration 


xx 
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2.4.2.  -  Le  jeu  d' instructions 

'.es  techniques  de  microprogrammation  permettent  ds  crAer  un  jeu  d‘ instructions  specialises  particu- 
lierement  simple  et  efficace  qui  utilise  au  mieux  la  rapiditA  des  micrcprocesseurs  bipolaires  et  qui  peut  Atre 
mis  en  oeuvre  sans  faire  appel  l  des  spAcialistes  informaticiens  : 

-  la  structure  multi-adresse  facilite  1’ecriture,  l’assemblage  et  la  verification  des  programmes  de 
regulation,  elle  correspond  par  ailleurs  au  mode  de  pensee  naturel  de  l’automaticien  (d'autant  plus  que  toutes 
les  instructions  du  groupe  R  sont  a  adressage  direct), 

-  le  choix  d'un  repertoire  spAcialisA  implants  par  microprogrammation  conduit  A  une  reduction  notable 
du  temps  d' execution  d'une  tAche  puisque  1 ‘ enchainement  des  microcommandes  est  du  type  explicite. 

Des  extraits  du  Jeu  destructions  de  l’automate  ELECMA  RN  1267  et  un  exemple  d’application  sont 
donnes  figures  13  et  14.  Dans  le  cus  ou  1 1  application  ne  justifie  pas  1 ’utilisation  de  microprocesseurs  micro- 
programmables  nous  remplaqons  les  instructions  spAcialisAes  par  des  macro-instructions. 

2.4.3.  -  Representation  des  donnAes 

Les  variables  rAelles  ayant  une  signification  physique  done  une  dynamique  bornAe,  nous  avons  choisi 
de  les  reprAsenter  en  complement  A  2  avec  un  cadrage  en  virgule  fixe. 

L'effet  des  troncatures  dans  les  multiplications  lorsqu’il  dAgrade  la  precision  est  compensA  par  des 
recadrages  ;  les  dApassements  intermediaires,  dans  le  cas  d’accumulat '.ons,  sont  facilement  dAtectAs  et 
corriges. 

3.  -  Les  structures  op£rationnelles 

Les  structures  opArationnelles  prennent  en  compte  la  sOretA  de  fonctionnement  du  systAme  de  regulation 
specifiAe  en  termes  de  fiabilite,  de  sAcuritA,  de  disponibilitA. 

3.1.  -  COMPOSANTES  DE  LA  SURETE  DE  FONCTIONNEMENT 

Le  systAme  peut  se  trouver  dans  les  Atats  suivants  : 

1 )  non  dAfaillant 

2)  dAfaillant  mais  en  panne  dAtectAe 

3)  dAfaillant  en  panne  non  dAtectAe 

la  ^iabititi  (R)  est  la  probability  de  se  trouver  dans  l’Atat  1  de  D  A  t. 

la  igcidtXtg  (S)  correspond  aux  etats  1  et  2  avec  dans  le  dernier  cas  le  maintien  des  grandeurs  de 
commande  A  une  valeur  prAdete:  minAe. 

la  dUAporiibiljXQ.  peut  §tre  mesurAe  par  le  MTBF. 

la  mUtvtmabilite  est  liAe  a  la  probability  de  localisation  et  de  rAparation  correcte  des  AlAments 
defaillants. 

3.2.  -  EVALUATION  DES  COMPOSANTES  OE  LA  SURETE  DE  FONCTIONNEMENT 


Les  outils  mathematiques  issus  de  la  thAorie  des  processus  stochastiques  permettent  un  accfes  systAma- 
tique  aux  composants  de  la  surety  de  fonctionnement.  Une  analyse  dAtaillAe  ainsi  que  de  nombreux  exemples  de 
structures  embarquAes  soumises  a  des  cycles  de  mission,  de  vArif ication,  de  garage  sont  donnAs  par  (LAP  75). 

Les  figures  15  et  16  montrent  la  necessity  d’une  Avaluation  rigoureuse  : 

-  les  gains  spectaculaires  bases  sur  des  hypotheses  simplistes  sont  souvent  illusoires, 

-  ll  est  facile  d’augmenter  les  ccuts,  le  volume  sans  gagner  sur  la  fiabilitA, 

3.3.  -  TECHNIQUES  DE  DETECTION  ET  DE  RECOUVREMENT  DES  PANNES 

3.3.1.  -  Les  structures  redondantes  conduisent  A  un  volume  materiel  important.  L’Avaluation  de  leur  fiabilite 
et  de  leur  sAcurite  doit  prendre  en  compte  les  probabilitAs  de  bonne  dAtection,  de  transmission  correcte  du 
contexte  et  1 ’existence  de  points  durs.  Les  pannes  de  mode  corrmun  (rAseau  de  bord,  environnement  physique), 
la  propagation  des  pannes  dans  les  structures,  les  doubles  pannes...  peuvent  conduire  A  des  performances 
tres  eloignees  des  performances  theoriques. 

3.3.2.  -  L1 implantation  locale  des  techniques  de  detection  et  de  recouvrement  des  pannes  permet  a  performances 
egales  de  diminuer  le  volume  materiel-  total.  Les  ressources  A  mettre  en  oeuvre  dApendent  des  sous-ensembles 
considAres. 

3. 3. 2.1.  -  Interfaces_d]entree;sqrtie 

Les  tests  de  vraisemblance  sur  les  valeurs  et  leur  gradient,  la  prAvision  de  1’Avolution  des  para- 
metres  peuvent  etre  complAtes  par  le  calcul  des  parametres  manquants  ou  par  la  mise  en  place  de  redondances 
au  niveau  des  capteurs  et  des  conditionneurs. 

3. 3. 2. 2.  -  Les  unites_centrales_S_microgrqcesseurs 

A  mains  de  concevoir  specialerent  un  microprocesseur  autotestable,  ll  est  pratiquement  impossible 
de  defimr  une  stratsgie  conduisant  A  un  autntest  a  haute  efficacitA,.  on  fera  done  appel,  si  necessaire,  a 
la  structure  de  la  figure  17  qui  bien  que  necessitant  4  unites  conauit  a  un  gain  de  consommation  par  rapport 
a  un  systAme  triplex,,  facilite  la  reconfiguration,  reduit  le  nombre  de  points  durs  (horloge  et  comparateurs 
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autotestables) . 

II  est  a  noter  que  des  unites  autotestables  peuvent  §tre  r6alis£es  avec  des  circuits  b  tr&s 
haute  density  d ’ integration. 

3. 3. 2. 3.  -  Les_men)oires 

Les  moyens  b  mettre  en  oeuvre  dependent  de  la  taille  m6moire,  de  la  duree  des  missions,  de  l'etat 
de  la  technologie  [organisation  de  la  memoire  et  modes  de  d§faillance)  ainsi  que  du  temps  accordS  &  la  detec¬ 
tion  et  au  recouvrement  des  pannes.  Les  techniques  appliqu6es  pour  de  grandes  capacites  mSmoire  ou  pour  les 
durees  de  mission  des  satellites  ne  sont  pas  transposables  directement  pour  des  r6gulateurs  numeriques  ou  Is 
taille  du  programme  est  comprise  entre  1  et  4  k  mots,  celle  de  la  memoire  de  travail  etant  de  l’ordre  de 
64  mots. 


La  detection  et  le  recouvrement  des  pannes  des  memoires  peuvent  faire  appel  aux  moyens  suivants  : 

-  La  checkium  appliqu6e  au  niveau  d'un  bloc  de  memoire  morte  permet  de  detecter  100  %  .,es  erreurs 

simples  et  environ  95  \  des  erreurs  doubles.  Des  variantes  -somme  arithmStique,,  calcul  des  rfisidus-  ameiiorent 

cette  efficacite.  Pour  la  memoire  programme,  la  cheksum  peut  6tre  appliqu6e  en  mode  d'autotest  ou  en  mode  de 
reprise  lorsqu'une  panne  est  d6tectee  par  des  chiens  de  garde  naturels. 

-  La  pancti  (plan  bit)  est  applicable  si  l'on  dispose  de  mots  de  1  bit  ou  si  on  organise  la  m6moire 

en  mots  de  1  bit.  On  peut  adjoindre  une  parite  crois6e  ou  un  codage  vertical  £  la  memoire  programme  et 

corriger  l'effet  d'une  panne  dStectee  si  on  accepte  une  degradation  du  temps  de  lecture  qui  se  r6v&le  dans  la 
plupart  sans  effet  notable  au  niveau  du  temps  d'execution  du  programme  (figure  18). 

-  Lei  techniquei  de  eodage  en  particulier  les  codes  de  Harming  d6tecteurs  et  correcteurs  d'erreur 
sont  particuliSrement  efficaces  pour  des  remoires  de  grande  capacite  (figure  19). 

-  Lei  tec.hm.qu.ei  louAdei  de  redondance  massive  ne  sont  pas  b  6carter  compte  tenu  de  1 'augmentation 
perms  jnte  des  densites  d ' implantation  (64  kbits  sur  un  chip)  et  de  la  realisation  des  voteurs  au  niveau  des 
unites  centrales. 

3. 3. 2. 4.  -  Les_liaisons 

Les  liaisons  qui  comprennent  les  fils  de  cablage  et  les  6metteurs-recepteurs  assnci6s  constituent 
des  points  durs  en  particulier  dans  les  systemes  multiprocesseurs.  La  transmission  en  mode  s6rie  parallele 
qui  assure  un  bon  compromis  entre  la  vitesse  des  transferts,-  la  reduction  du  volume  materiel,  est  fiabilis6e 
par  des  techniques  de  redondance  cu/et  de  codage,  comme  celles  appliqu6es  aux  memoires. 

3.4.  -  AMELIORATION  DES  TAUX  DE  PANNE  DES  COMPOSANTS 


Les  pannes  des  composants  Alectroniques  restent  inevitables  malgre  les  progrfes  de  la  technologie. 

La  prise  en  compte  de  leur  existence  lors  de  la  conception  permet  d'en  minimiser  les  effets  sur  le  comporte- 
ment  du  systeme  mais  ne  resoud  pas  completemont  les  probl&mes  : 

-  de  subsistance  des  points  durs,- 

-  de  disponibilite  des  systemes  (on  a  vu  pour  ce  fairs,;  proposer  des  structures  a  onze  calculateurs 
triples) ,. 

-  de  maintenance  (diagnostic  et  reparation  imparfaits  avec  leur  effet  nSgatif  sur  la  sficurite) . 

Le  taux  de  panne  des  composants  peut  Stre  reduit  par  divers  moyens  : 

-  choix  des  filieres  technoiogiques  appropriees  et  connaissance  fine  de  leur  comportement, 

-  choix  des  techniques  de  deverminage  tant  pour  les  composants  que  pour  les  ensembles,, 

-  qualification  des  fournisseurs, 

-  controles  d'entree  renforces. 

Par  ailleurs,  la  majonte  des  pannes  etant  induites  par  des  contraintes  exterieures,  une  bonne  con¬ 
naissance  de  1 ' environnement  du  regulateur  electronique  permet  de  mettre  en  place  des  moyens  destines  b  en 
reduire  1 'agressivite. 

On  peut  esperer  que  1’ ensemble  des  actions  precitees  permetuont  d'obtemr  pour  les  regulateurs 
electroniques  des  taux  de  pannes  analogues  a  ceux  des  systemes  hydromecamques  (KUH,  76). 

4.  -  CONCLUSION 


Les  circuits  a  haut  niveau  d ’  integration,  en  particulier  les  microproceaseurs ,  ouvrent  de  r.ouvelles 
perspectives  dans  1 ’ elaboration  des  systemes  de  regulation  de  moteur.  L ' util isa-ior  d’outils  ngoureux 
d1 analyse  et  d’ evaluation  est  necessaire  pour  faire  les  nembreux  choix  techniques  qui  conduisent  aux 
structures  les  mieux  appropriees. 

La  diversity  des  architectui es  possibles  pel  met  d'envisager  des  solutions  adaptees  dans  chaque  cas  aux 
objectifs  fixes.  Pour  les  applications  simples,  des  regulateurs  compacts  et  economiques  sont  realisables. 
PouT  les  applications  plus  complexes,  de  hautes  performances  sont  accessibles  par  1 'adoption  de  microproces- 
seurs  puissants  ou  d 'architectures  mul tipi ocesseurs .  Ces  derniei s  constituent  egalement  la  base  de  legula- 
teurs  surs  de  fonctionnement  raisonnaolement  realisables. 

i 
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DISCUSSION 


J.Dunhain,  UK 

What  type  of  microprocessor  do  you  use?  How  many  microprocessors  do  you  consider  necessary  (in  a  single 
control  lane)  to  achieve  satisfactory  control  of  reheated  engine? 

Author’s  Reply 

-  We  have  been  using  a)  IM  6 1 00  12  bit  CMOS 

b)  Intel  3000  2  bits-slice 

now  after  evaluation 

RCA  1802  8  bits  CMOS 
2900  AMD  a  bits  slice 

tomorrow  -  CMOS/SOS  version  of  6800 
-  CMOS/SOS  version  of  2900 

we  refuse  dynamic  MOS  microprocessor 
1*  L.  too  early  monosomie 

Reheated  engine 

functional:  4  x  1802  or  1  micro  -  programmed  2900. 

16  bits  slice 


I.S.D.Stitt,  UK 

Keyword-Reconfiguration:  The  paper  says  that  in  the  event  of  a  microprocessor’s  failure  in  a  multiprocessor  the 
computation  is  reconfigured  so  that  the  system  will  continue  to  give  correct  control  outputs.  Can  the  author  say 
how  this  reconfiguration  of  the  tasks  pei  formed  by  the  microprocessors  is  achieved? 

Author's  Reply 

The  main  processor  (permitted  by  technique  of  massive  redundancy)  detects  the.  fault  and  stops  the  outputs  for  20 
to  (50?)  ms,  after  which  it  seeks  a  new  table  of  tasks  in  keeping  with  the  reconfiguration. 

Provided  that  the  number  of  processors  is  sufficient,  performance  is  maintained  in  full,  other  wise  operation 
continues  with  reduced  performance.  In  the  worst  case,  resort  is  made  to  the  hydromechanical  emergency  control. 

D.Mouranche,  Fr 

In  your  personal  experience,  have  you  been  able  to  establish  progress  in  the  reliability  of  components  parallel  to 
progress  in  the  performance  and  miniaturisation? 

Author's  Reply 

Wlieie  progress  concerns  complexity  and  number  of  functions  offered  Yes. 

!n  reliability  or  even  only  in  availability  for  military  purposes  No 
(Manufacturers  develop  cars  and  washing  machines) 
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THE  DESIGN  CONCEPT  AND  EXPERIMENTAL  RESULTS  U.'.ING 
THE  INTEL  8080/8085  MICROPROCESSOR 

by 

Nicholas  A.  Justice  M.Sc.,  M.Inst.  M.  &  C. 
Chief  Engineer 

HAWKER  SIDDELEY  DYNAMICS  ENGINEERING  LIMITED 
Manor  Road 
Hatfield 

Hertfordshire  ALIO  9LJ 
England 


SUMMARY 


Having  been  involved  for  over  twenty  years  in  gas  turbine  control  systems,  the 
advent  of  the  microprocessor  gives  an  ideal  opportunity  to  improve  on  both  the  system 
control  aspects  and  the  unit  cost.  The  choice  of  microprocessor  is  fundamental  to  the 
capability  expected  but  the  following  discussion  concentrates  on  how  the  INTEL  8080/8085 
series  were  chosen  to  meet  the  requirements  of  a  simplex  fuel  control  system. 

Prototype  flight  equipment  has  been  built  using  the  8080A  and  is  flying  with  full 
authority  in  a  twin  engine  helicopter.  Isochronous  load  sharing  on  torque  with 
simultaneous  data  logging  output  of  transducer  inputs  and  control  functions  is  provided 
for  monitoring  purposes. 

This  detailed  background  is  providing  valuable  insight  to  the  true  flexibility  of  a 
microprocessor  controller  and  also  illustrates  any  shortcomings  that  the  later  generation 
devices  will  need  to  overcome. 

A  fundamental  CPU  speed  increase  from  2  MHz  to  3  MHz  using  the  0085  gives  an 
immediate  improvement  and  further  margin  for  growth  on  current  8000  designs.  Power 
supply  simplification  for  single  rail  devices  are  also  significant  in  reducing  the 
complexity  of  construction  and  cost. 

The  final  mam  impact  of  any  microprocessor  R.  &  D.  activity  is  the  ability  to  re¬ 
use  previously  developed  software.  Where  the  unit  cost  is  continually  falling  so  does 
this  element  become  more  significant.  Because  of  upward  compatible  software  for  the 
8080/8085  series,  a  library  of  control  software  has  been  built  up  which  can  now  enable 
new  control  schemes  to  be  implemented  to  high  confidence  levels  within  weeks  instead  of 
months . 


CHOICE  OF  MICROPROCESSOR 


For  gas  turbine  engine  fuel  control  system  tasks,  the  mam  criteria  for  the  choice 
of  a  microprocessor  are  as  follows :- 


(1)  Sufficient  speed  and  software  repertoire  to  be  able  to  undertake  the  control 
ta_ks  m  the  time  available. 

(2-  r,,,,ven  semiconductor  technology  offering  the  required  basic  reliability  to 
the  components  and  m-volume  production. 

(3)  Well  supported  microprocessor  development  equipment  with  appropriate  software 
aids  to  speed  application  developments,  and  reduce  the  amount  of  first-time 
software. 

(4)  A  powerful  supporting  chip  set  for  the  basic  microprocessor,  thus  reducing  the 
overall  system  component  count  and,  if  smart  interface  chips  are  available, 
generally  increasing  its  overall  ^peed  capability. 

(5)  For  Military  applications,  the  chip  set,  including  microprocessor,  must  be 
available  to  the  required  temperature  range  of  -55°C  to  +125°C  and  meet  BS9000 
or  MIL-STD-883,  preferably  with  JAN  or  BS9400  approval. 

(6)  Multi-sourced  microprocessor  and  supporting  chip  set  ensuring  flexibility  and 
continuity  of  supply. 


.vVv 
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Review  and  experience  of  several  devices  employing  different  semiconductor 
technologies  and  with  data  word  lengths  ranging  from  8  to  16  bits  concludes  m  the 
selection  of  the  INTEL  8080/8085  series  for  simplex  fuel  control  applications.  The 
devices  considered  are  all  rated  for  operation  over  the  full  temperature  range,,  and 
include: - 


MANUFACTURER 

PART  NUMBER 

DATA  WORD 

TECHNOLOGY 

Intel 

M8085A 

8  bits 

NMOS 

Intersil 

TM6100A 

12  bits 

CMOS 

Texas  Instruments 

SPB9900A 

16  bits 

I2L 

Previous  experience  has  shown  that  it  is  desirable  to  perform  fuel  flow  calculations 
with  a  resolution  of  at  least  10  bits  (.1%)  and  t> at  the  programme  cycle  time  should  be 
short  enough  to  allow  the  calculation  to  be  updal  ,*d  approximately  every  16  milliseconds. 
The  advantages  and  disadvantages  of  the  various  processors  may  be  summarised  as  follows 


(a)  INTEL  M8085A 

The  8  bit  data  word  requires  the  use  of  double  precision  arithmetic  m  some 
calculations,  but  this  is  facilitated  by  a  number  of  instructions  which 
operate  on  register  pairs.  8  bit  operation  also  fits  in  well  with  the  use 
of  standard  memories. 

The  instruction  set  lacks  multiply /divide  instructions,  necessitating  the  use 
of  external  hardware  or  software  routines.  Depending  on  the  application,  a 
balance  is  struck  between  using  a  hardware  multiplier  (also  now  available  as  a 
single  rail  device),  or  the  extra  memory  and  processing  time  that  a  software  alone 
approach  implies.  We  have  developed  certain  software  techniques  which  allow 
critical  fuel  flow  calculations  to  be  updated  in  the  required  time  without 
additional  hardware.  These  have  already  been  successfully  demonstrated  using 
the  8080A.  With  the  8085A  speed  increase  of  50*,  the  same  routines  can  be  used 
with  even  greater  safety  margins.  The  single  5V  power  supply  of  the  8085  also 
overcomes  the  other  disadvantages  of  the  8080A's  more  complex  supply  requirements. 

The  semiconductor  manufacturer  is  fully  committed  to  the  development  of  Military 
temperature  range  components,  the  8080A  being  the  first  microprocessor  to  be  JAN 
qualified,  with  an  M38510  slash  sheet.  Similar  action  is  anticipated  for  the 
8085A  which  is  second-sourced.  Above  all,  the  microprocessors  are  fully 
supported  by  a  family  of  compatible  interface  components,  and  it  is  these  that 
enable  very  low  component  count  controllers  to  be  configured.  For  future  growth 
INTEL  is  developing  a  family  of  software  compatible  devices  including: - 


(1)  8086  -  a  16  bit  microprocessor  with  advanced  instruction  set 

(2)  8088  -  a  16  bit  microprocessor  with  8  bit  data  bus,  ideally  suitable 

for  upgrading  from  8085 

(3)  8048  -  an  8  bit  single  chip  microcomputer 

The  whole  microprocessor  family  is  extremely  well  supported  with  hardware  and 
software  development  aids. 


(b)  INTERSIL  IM6100A 

At  first  sight  the  12  bit  data  word  appears  ideally  suited  for  the  resolution 
requirements.  However,  since  most  standard  memories  are  partitioned  into  8 
bit  words,  it  proves  to  be  wasteful  of  memory.  The  lower  power  CMOS  technology 
is  an  advantage  in  some  applications,  particularly  battery  powered,  and  the 
microprocessor  is  second-sourced. 

The  processor  uses  the  Digital  Equipment  Corporation  PDP-8E  instruction  set. 

This  makes  available  a  very  extensive  repertiore  of  proven  software  techn- lues 
but  the  instruction  set  is  now  outdated  and  limited  compared  with  more  recent 
developments . 
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The  other  major  disadvantages  are  its  slow  operation,  and  the  absence  of 
multiply /divide  instructions,  necessitating  the  use  of  external  multiply 
hardware. 

Although  the  microprocessor  has  now  been  available  for  several  years,  there  has 
been  little  evidence  of  the  development  of  compatible  interface  components,,  and 
more  advanced  processors . 


(c)  TEXAS  INSTRUMENTS  SPB9900A 

Experience  of  similar  control  requirements  has  been  gained  on  this  device  and 
the  INTEL  8080.  It  is  a  16  bit  microprocessor  w ith  a  powerful  instruction  set, 
including  multiply  and  divide,  making  it  possible  to  meet  the  resolution  and 
programme  cycle  time  requirements  with  a  very  straightforward  software  approach. 

The  16  bit  processor  requires  fewer  words  of  memory  than  the  8  bit  design,  with 
double  precision  arithmetic,  but  the  double  word  length  results  in  the  use  of 
somewhat  more  memory  overall.  The  16  bit  data  and  address  busses  result  in 

the  need  for  a  large  (approximately  76  mm  x  25  mm)  64-pin  package.  The 

device  is  one  of  a  fairly  extensive  family  of  compatible  parts,  but  most  of  the 
other  components  are  only  available  in  limited  temperature  range  TMS  (NMOS) 
version,  e.g. 

(1)  9980  -  a  16  bit  processor  with  8  bit  data  bus 

(2)  9940  -  a  single  chip  computer  version  of  the  9900 


Although  the  processor  has  been  available  for  approximately  two  years,  there  is 
still  no  second  source  for  the  full  temperature  range  version.  This,  together 
with  its  mere  limited  application ,.  results  in  the  cost  remaining  relatively  high. 


(d)  SUMMARY 

With  the  above  experience,  and  considering  the  complexity  of  typical  gas  turbine 
controls,  especially  in  the  helicopter  field,  the  8085A  mi  iroprocessor  is  selected 
as  the  most  suitable.  It  offers  the  lowest  cost  approach,  both  m  the  micro¬ 
processor  itself  and  its  supporting  hardware.  Based  on  trials  already  carried 
out  using  the  8080,  the  speed  increase  from  the  8085  will  leave  sufficient 
capacity  for  future  growth  and  incorporation  of  added  features  such  as  data 
logging  and  certain  health  monitoring  functions. 


SOFTWARE  STRUCTURE 


With  the  upwards  compatible  nature  of  the  software  evolveci  for  the  INTEL  8080/8085 
series  microprocessors  it  is  useful  to  consider  how  the  control  system  is  built  up.  The 
software  system  is  put  together  m  modular  blocks  of  programme,  each  block  performing 
clearly  defined  functions,  e.g.  Nf  governing,  system  initialisation,  etc.,  generally 
having  one  entry  and  one  exit  p'int.  This  leads  to  increased  software  reliability. 

Each  software  block  is  developed  using  facilities  offered  by  INTEL'S  ISIS-II  system, 
resident  m  MDS-80/ICE-80/ICE-85 .  Tye  ISIS-II  assembler  or  PLM  compiler  generates  a 
relocatable  object  code  file,  from  an  assembler  source  module,  which  can  be  linked 
subsequently  with  ocher  modules  needed  to  complete  the  software  system. 

Thus,  during  development  a  module  would  be  linked  into  a  test  environment  for 
debugging  purposes.  The  tested  module  would  then  be  linked  into  its  final  system,  with 
full  confidence  that  the  tested  performance  will  be  maintained. 

The  software  package  during  development  resides  on  floppy  disk  media  as  a  number  of 
module  files.  Each  module  will  have  an  assembler  source  code  file,  with  its  relevant 
object  file  described  above,  as  well  as  a  list  file,  generated  at  assembly/compiler  time. 
Also  resident  on  disk  is  a  file  containing  all  the  modules  linked  together,  which  is 
transferred  to  memory  giving  a  runnable  software  system.  Speed  of  programme  run  time 
operation  within  the  confines  of  maintaining  programme  modularity  has  been  used  as  the 
highest  criterion  during  software  design  and  development.  Thus,  a  Higher  run  time  speed 
will  always  be  achievable  at  the  expense  of  software  reliability,  and  diminished  returns 
during  the  development  period.  As  with  all  fast  software  systems,  speed  gives  rise  to 
the  use  of  increased  memory  space.  This  is  not  seen  as  a  particular  problem  m  the 
light  of  the  tendency  of  increasing  memory  space  with  decreasing  cost. 


For  example  a  straightforward  shift  and  add/multiply  technique,  using  in-line  coding, 
rather  chan  a  looping  system,  will  provide  speed  at  the  expense  of  the  use  of  extra 
memory . 

As  an  illustration  of  the  control  software  library  built  up  by  our  Company  using 
the  INTEL  family  of  microprocessors  whilst  running  on  the  test  bed  various  gas  turbines, 
the  latest  flight  demonstrator  system  utilises  nearly  50%  of  existing  software  modules. 
With  the  benefit  of  these  trials  it  is  expected  that  future  controls  would  require  less 
than  30%  of  new  software  which  can  be  seen  as  a  tremendous  benefit  in  choosing  such  a 
family  of  microprocessors. 

As  fuel  control  systems  are  fast  acting,  the  software  timing  plays  a  critical  part 
in  the  execution  of  the  various  control  packages.  To  aid  the  structuring  of  the 
software,  and  its  appropriate  timing,  a  major/minor  cycle  map  is  produced  that  separates 
the  high  priority  and  low  priority  tasks. 

The  major  cycle  is  that  time  in  which  all  control  tasks  must  be  carried  out,  which 
in  most  aero  engine  control  systems,  usually  lies  between  .1  to  .5  seconds.  The  minor 
cycle  is  that  time  witnin  which  some  control  tasks  must  be  serviced  to  achieve  control 
stability.  For  the  typical  aero  engine,  this  usually  requires  a  rate  of  servicing 
between  16  and  20  milliseconds. 

Within  this  framework  the  major/minor  cycle  map  is  then  constructed  to  optimise 
the  process  of  throughput  while  meeting  the  control  stability  requirements.  Our 
experience  to  date  has  indicated  this  results  in  a  major  cycle  being  composed  of  between 
8  to  32  minor  cycles,  depending  on  the  complexity..  The  sampling  and  subsequent 
processing  of  each  input  signal  is  performed  at  a  rate  consistent  with  the  frequency 
content  and  response  time  of  that  signal  and  its  associated  control  loop.  Ir.  a  typical 
helicopter  control  the  throttle  angle,  torque,  and  speed  achi evrd  signals  are  processed 
at  full  rate.  The  remaining  inputs  are  processed  at  slower  rates,  but  not  less  tha 
every  major  cycle. 

This  multiple  sample  rate  technique  has  the  dual  advantage  of  minimising  truncation 
errors  caused  by  sampling  at  tc.o  high  a  rate,  and  of  avoiding  the  necessity  of  performing 
all  functions  within  the  sample  period  required  by  the  highest  frequency  loop,  and  gives 
flexibility  m  avoiding  input  aliasing  problems.; 

The  general  software  stiucture  as  outlined  enables  the  majority  of  failure  checking 
software  also  to  be  completed  within  each  minor  cycle.  Based  on  a  nominal  16  milli¬ 
second  minor  cycle,  the  main  software  response  from  a  fault  to  a  freeze  on  the  output 
actuator  would  occur  within  this  time.  It  is  important  to  structure  the  output  actuator 
and  its  relation  to  the  number  of  steps  in  any  direction  so  that  the  failure  response 
is  achievable  within  a  relatively  small  fuel  flow  and  hence  engine  power  change. 

The  memory  capacity  for  a  current  8085  design  providing  full  simplex  control  of 
a  helicopter  is  typically  6i<  by  8  of  ROM  and  500  words  of  RAM. 


PROCESSING  OF  INPUT  SIGNALS 


The  very  efficient  peripheral  components  of  the  8085  system  enable  a  very 
efficient  circuit  structure  resulting  in  the  complete  interface  being  configured  using 
very  few  discrete  components.  This  has  a  direct  bearing  on  reliability  and  cost. 

Speed  Signals 

A  single  LSI  chip  can  process  three,  frequency  signals  i nul taneously  once  they  are 
suitably  filtered  and  squared  from  the  raw  signal  source.  Tin  software  organises  the 
rate  of  access  to  the  registers  containing  the  speed  mformati  ,n  on  the  LSI  chip,  rather 
than  using  an  interrupt.  It  is  only  necessary  to  provide  suf f ,  •"  ent  counts  within  the 
sample  time  to  meet  the  resolution  requi  rements.  To  meet  a  .1%  ,  '.-olution,  at  least 
1,000,  and  generally  more  counts,  a*e  required,  and  using  the  sampi  “.eriod  of  16  milli¬ 
seconds  frequency  multiplication  is  usually  necessary. 

This  is  achieved  using  phase  locked  loops  and  low  pass  filtering  is  effected  around 
the  loop  thus  minimising  noise  and  frequency  modulation  effects. 

With  the  slower  8080  the  added  benefit  of  having  frequency  as  a  direct  value 
instead  of,  as  is  usually  the  case  for  interrupt  measuring  systems,  a  val  e  proportional 
to  the  period  of  the  incoming  frequency,  the  requirement  for  a  divide  ope  ^tion  was 
avoided.  With  the  faster  8085,  avoidance  of  this  task  may  not  be  so  necessary,  and  a 
more  optimum  hardware  structure  will  be  configured. 
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Analogue  Signals 

The  various  analogue  signals  are  multiplexed  m  a  conventional  12  bit  analogue  to 
digital  converter,  operating  directly  under  the  microprocessor  control.  This  results 
m  optimum  sampling  of  those  signals  with  respect  to  the  control  system  requirements. 

For  low  signal  inputs,,  such  as  thermocouples,  software  manipulation  of  both 
signal  and  reference  voltages  is  carried  out,,  so  that  automatic  gain  and  offset  changes 
with  temperature  and  time  are  automatically  carried  out.  This  is  typical  of  the 
features  that  a  microprocessor  can  offer  over  the  conventional  analogue  approach  which 
would  require  very  expensive  components  to  achieve  the  same  order  of  accuracy. 


OUTPUT  INTERFACE 


Almost  all  of  the  fuel  control  systems  operate  in  conjunction  with  a  multi-phase 
stepper  motor.  For  aircraft  systems,  this  is  more  desirable  as  the  failure  mode  is 
intrinsically  fail-freeze.  The  fundamental  design  concept  of  utilizing  the  intelligence 
of  the  microprocessor  to  its  full  is  seen  in' this  function.  The  requisite  bit  pattern 
that  ensures  cLockwise  or  anti-clockwise  rotation  is  totally  software  generated,  prior  to 
'writing'  to  the  peripheral  output  circuit. 

Furthermore,  a  separate  gating  function  is  interposed  between  the  peripheral  and 
each  power  switch  such  that  pulse  width  modulation  of  the  stepper  motor  phase  drive  takes 
place  as  a  function  of  the  aircraft  supply  voltage.  The  actual  timing  is  generated  by  a 

counter /timer  peripheral  component  under  direct  software  control.  During  severe 
transients,,  where  high  slew  rate  demands  exist,,  maximum  power  is  delivered  to  the  stepper 
motor  for  the  appropriate  period,  again,  dictated  by  software  analysis  of  the  actual  valve 
position  compared  to  the  demanded  step  input.  In  this  way,  dissipation  in  the  stepper 
motor  is  minimised  without  prejudicing  torque  requirements  for  control  purposes. 

Serial  Output  Interface 

The  availability  of  communication  chips  that  are  directly  supported  on  the  bus 
structure  of  the  microprocessor  adds  a  bonus  to  the  basic  controller.  The  ability  to 
talk  to,  interrogate,  and  to  receive  data  from  a  controller  in  parallel  with  its  primary 
control  tasks,,  orovides  the  system  designer  with  test  features  (on  the  ground  and  in 
flight)  and  a  source  of  engine  and  airframe  parametric  information  suitable  for  other 
processing  needs. 

Whilst  great  care  must  be  taken  to  establish  the  integrity  of  the  primary  controller 
when  such  a  serial  interface  is  operational,,  the  power  of  the  microprocessor  enables  quite 
significant  data  transmissions  to  occur  even  m  the  background  time  relative  to  the  main 
programme.  Our  experience  to  date  has  shown  that  as  many  as  30  8  bit  parameters  could 
be  output  every  ^-second  at  a  processing  time  of  only  150  microseconds  per  16  millisecond 
minor  cycle  for  the  8080A  and  proportionally  less  for  the  8085.  This  data  can  be  any 
parameter  that  the  controller  has  access  to,  as  well  as  any  internally  generated  function. 
This  feature  is  very  useful  during  the  flight  trials  as  a  close  monitor  on  control  system 
performance  and  fault  diagnosis. 

The  I/O  port  discussed  is  based  on  the  industrial  RS232C  protocol  but  for  future 
avionic  systems  the  ARINC  or  MIL-STD-1553  standards  are  usually  desirable  or  mandatory. 

Already,,  the  INTEL  8080/8085  bus  structure  can  now  support  ar.  off-the-shelf  system 
comprising  a  specially  microprogrammed  controller  mounted  on  a  single  ATR  compatible 
printed  circuit  board.  This  unit  could  service  such  a  bus,  yet  not  place  the  high 
demands  on  the  engine  control  processor.  In  fact,  the  circuit  is  designed  to  appear  as 
another  addressable  peripheral,,  and  compatibility  with  1553,  1553DAIS  or  1553B  is 
achievable  with  PROM  changes  only. 


IMPROVED  CONTROL  SCHEMES 


The  ability  of  a  digital  system  to  generate  complex  functions  relatively  easily 
compared  to  the  complex  circuitry  for  the  equivalent  analogue  controller,  enables  the 
system  designer  to  more  closely  match  rhe  controller  to  the  engine.  Our  particular 
experience  is  illustrated  by  the  ability  to  provide  cooler  starts  (of  the  order  of  50°c) 
for  a  given  engine  by  shaping  the  start  and  temperature  limiting  functions. 
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•This  is  an  area  where  the  engine  manufacturer  is  particularly  conscious  from  the 
point  of  view  of  engine  life.  Also  from  the  operational  point  of  view,  the  pilot  is 
usually  looking  for  consistent  starting  times,  in  the  case  of  VSTOL  aircraft,  faster  and 
more  consistent  accelerations  under  varying  engine  and  ambient  conditions.  Successful 
control  schemes  have  been  implemented  whereby  acceleration  on  fixed  or  variable  Ndot 
(rate  of  change  of  gas  generator  speed)  have  eliminated  the  variation  of  engine 
performance  from  ambient  air  temperature  and  engine  conditions  m  achieving  idle  and 
maximum  speeds.  The  flexibility  of  the  digital  controller  approach  means  that  various 
alternative  starting  schemes  can  be  tried  during  development,  thus  optimising 
performance  for  any  production  design.  So  long  as  the  required  input  parameters  are 
available  in  the  basic  control,  these  alternative  schemes  would  require  only  software  re¬ 
arrangement. 

Integration  of  fully  automatic  start  schemes,  whereby  ignition  and  starter  relays 
come  under  direct  control  of  the  fuel  control  system,  provide  for  more  total  integration 
of  the  engine  controller.  Good  experience  has  been  gained  to  date  on  industrial  gas 
turbine  start/stop  sequencing  systems,  and  the  benefits  of  providing  the  complex  inter¬ 
locks  usually  required  have  been  realised.  The  ability  to  piovide  for  a  variety  of 
control  schemes  for  the  primary  loop  or  loops  implies  on  the  basic  design  concept  that 
sufficient  memory  and  processing  power  is  available.  Experience  or.  five  widely  varying 
gas  turbine  applications,  namely 

(1)  An  industrial  standby  generating  set 

(2)  A  high  performance  vectored  thrust  engine 

(3)  A  marine  gas  turbine 

(4)  Two  very  different  gas  turbines  for  medium  helicopter  applications 
has  resulted  in  the  optimum  memory  requirement  illustrated  previously. 


INTEGRITY  AND  RELIABILITY 


As  our  experience  lies  particularly  m  the  helicopter  controls  field,  where  the 
simplex  control  is  advocated,  with  an  alternative  manual  reversionary  control,  the 
concept  of  integrity  bears  some  importance.  Tt  is  normal  with  conventional  analogue 
control  systems  to  provide  some  form  of  safety  circuit  to  prevent  throttle  runaway  up 
or  down,  in  the  event  of  a  component  failure.  The  microprocessor  digital  controller 
provides  this  facility  because  most  of  the  possible  failure  modes  produce  complete 
freeze  of  the  control  system.  There  are,  however,  still  some  modes  of  failure 
particular  m  the  read  only  memories,  which  may  produce  runaway  up  or  down,  but  whose 
failure  can  be  detected  by  'nternal  checks,  which  form  a  particular  part  of  the  digital 
control  software  programme. 

The  analogue  to  digital  converter  and  multiplexer  are  checked  by  having  one 
channel  with  a  fixed  reference  voltage  whose  value  the  computer  checks  for  correctness 
every  sample  period. 

The  analogue  circuits  which  input  to  the  control  system  are  checked  at  circuit 
level  for  validity  and  frequency  inputs  are  checked  for  their  correct  'window'  of 
operation,  relative  to  other  engine  parameters.  The  stepper  motor  and  resolver  are 
checked  continuously  by  virtue  of  the  overall  software  technique  utilised,  which 
compares  the  movement  of  the  resolver  for  a  given  series  of  step  demands,  so  that  either 
item  can  be  checked  for  gross  failures  and  any  parametric  detenorisation  of  the 
resolver  itself.  A  given  number  of  steps  must  always  result  in  a  certain  angular 
movement  through  the  gearbox  and  resolver. 

It  is  generally  arranged  that  during  a  start  up  sequence,  the  stepper  motor  is 
exercised  over  a  small  number  of  steps,  and  the  corresponding  resolver  movement 
checked.  During  this  brief  cycle  the  above  checks  will  automatically  be  carried  out 
and  the  pilot  would  have  an  early  warning  of  any  fuel  metering  element  malfunction 
prior  to  engaging  the  starter. 

Because  the  multi-phase  pulse  train  to  the  stepper  motor  is  software  organised 
a  very  high  integrity  system  results.  In  all  the  microprocessor  controllers 
developed  to  date,  this  has  involved  the  processor  in  going  to  memory  for  a  look-up 
table,  returning  and  outputting  the  correct  multi-phase  pulse  tram  to  drive  the 
motor  and  then  returning  to  its  original  task.  Errors  m  the  multi-phase  pulse  train 
invariably  cause  the  motor  to  freeze.  In  this  manner,  therefore,  a  whole  host  of 
processor  features  must  work  correctly  for  the  actuator  to  be  driven  at  all,  and  the 
failure  modes  of  the  processor  being  able  to  correctly  do  this  task,  and  incorrectly 
do  other  tasks  are  extremely  remote. 
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Our  current  design  philosophy  for  recording  any  malfunction  is  to  enter  the  fault 
occurrence  and  its  cause  as  determined  Lj  the  safety  checking  software  into  non-volatile 
memory  (EAROM  -  Electrically  Alterable  Read  Only  Memory;.  Devices  are  now  on  the 
market  that  have  full  Military  temperature  ranqe  operation  with  read/write  cycle  life 
limitations  far  in  excess  of  any  practical  requirement. 

The  ability  tc  have  access  to  this  form  of  memory  via  a  serial  I/O  will  provide 
valuable  fault  diagnosis  information  on  those  faults  that  may  be  intermittent  and  not 
reproducible  on  the  ground. 

Conservative  reliabil’ty  predictions  for  a  typical  airframe  mounted  microprocessor 
controller  are  m  the  region  of  10,000  to  20,000  hours.  This  is  already  compatible 
with  the  well  proven  analogue  approach,,  and  is  expected  to  mature  as  experience  is 
gained  m  service  use. 


CONCLUSIONS 


All  the  experimental  results  to  date  during  the  various  engine  trials  and  development 
tests  point  tc  the  wider  acceptance  of  microprocessor  controllers  for  stringent  control 
requirements.  The  initial  concern  whether  the  microprocessor  could  meet  the 
performance  goals,,  especially  the  8  bit  family  such  as  the  INTEL  8080/8085,,  has  now 
been  dispelled.  Furthermore,  the  sensitivity  of  digital  circuitry  to  the  harsh  RFI 
and  EMC  environments  has  not  been  seen  as  a  problem.  Current  designs  have  satisfied 
MIL-STL-461A  and  MIL-STD-704A  tests  whilst  the  packaging  and  environmental  aspects  are 
relatively  straightforward. 

The  'on-engine'  microprocessor  controller  that  replaces  its  hydromechanical 
equivalent  is  now  available  with  competative  price,,  weight  and  reliability  factors. 
Performance,,  growth  and  flexibility  have  now  been  proven  to  be  significantly  greater 
than  the  analogue  counterpart  which  leaves  the  engine  and  airframe  manufacturer  wide 
scope  for  system  improvements . 


DISCUSSION 


D.T.Hawes,  Ca 

Why  don’t  you  use  interrupt  driven  Foreground-Background  scheme  thus  utilising  the  30  50%  capacity  apparently 
wasted  in  the  scheme  described. 

Author’s  Reply 

The  spare  capacity  is  designed  in  to  ensure  a  software  margin  of  safety.  However,  there  are  tasks  carried  out  in  this 
time,  e.g.,  displaying  parameters  on  a  serial  communications  line,  that  can  be  interrupted,  and  also  which  do  not 
require  to  be  complete  within  each  minor  cycle. 


W.Merrill,  US 

Your  presentation  indicated  most  of  your  /iP  controls  are  mounted  but  that  you  are  beginning  to  look  at  off-engine 
mounted  controllers.  What  is  your  motivation  for  doing  so?  What  location  philosophy  do  you  intend  to  adopt  in 
the  long  term?  Do  you  anticipate  resistance  to  ofi-engine  mounted  pP  controls  from  airframe  manufacturers  who 
might  use  your  engine  control  systems. 

Author’s  Reply 

The  motivation  for  an  off-engine  controller  is  primarily  the  basic  cost  comparison  of  the  controller  itself.  Milder 
temperature  and  vibration  requirements  allow  simpler  solutions  within  the  controller  and  generally  the  lewer 
mechanical  constraints  allow  for  more  optimum  and  cost  effective  packaging. 

Either  location  can  be  made  available  depending  on  engine/airframe  requirements.  The  on-engine  philosophy  is 
superior  from  an  interface  point  of  view. 

Yes,  from  the  integrity  aspects.  No.  from  the  overall  cost  point  of  view.  However,  very  often  for  small  to  medium 
helicopters,  the  distance  between  an  engine-mounted  environment  and  airframe  is  orly  a  few  feet. 


J.M.Collin,  Fr 

( 1 )  Why  have  you  not  used  Ferranti? 

(2)  Is  pp  standaidised  in  Great  Britain? 

(3)  Have  you  encountered  problems  with  dynamic  operation  at  elevated  temperatures? 

(4)  Do  vou  believe  complicated  peripherals  will  be  available  for  military  purposes? 

Author’s  Reply 

( 1 )  For  commerccial  applications  cost  is  the  main  objection  and  our  company  has  chosen  to  use  the  INTEL  range 
for  all  avionic  applications. 

(2)  No. 

(3)  No  because  of  the  structured  format  in  that  all  tasks  must  be  completed  within  defined  time  hurts,  tempera¬ 
ture  effects  are  not  applicable. 

(4)  Yes.  As  has  been  demonstrated  on  most  peripheral  components,  full  military  temperature  range  and  quality 
processing  is  being  applied  to  the  most  popular  elements  those  that  make  up  the  heart  of  the  central 
processing  system. 


R.  Smyth,  Ge 

Key  word1  Engine  Health  Monitoring.  What  type  of  engine  health  monitoring  is  used?  Is  it  limit  exceedance 
control  or  does  it  monitor  pressures,  temperatures  and  fuel  flow  as  a  function  of  NA/T7  on  the  well  known  non- 
dimensional  basis? 

Author’s  Reply 

Health  monitoring  in  conjunction  with  tile  contioi  tasks  is  at  the  moment  limited  to  transducer  validation  and  cross¬ 
correlation  to  other  engine  parameters. 

As  tile  power  of  the  processoi  extends  so  will  be  incorporated  true  health  monitoring  and  even  trend  analysis  based 
on  the  non-diniensional  parameters  and  gas  path  analysis.  Separately  these  tasks  have  been  accomplished  using  the 
INTEL  series  of  processors  in  the  field  of  Industrial  Gas  Turbines  and  the  software  and  mathematical  approaches 
will  be  combined  into  the  avionics  field. 
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I.S.D.Stitt,  UK 

Key  word.  Fault  Tolerance.  The  paper  claims  that  the  software  was  fault  tolerant  but  the  example  given  was  that 
the  software  was  re-initiated  and  ignoied  transiently  detected  faults.  The  question  requested  the  author's  definition 
of  fault  tolerant  software  and  for  examples. 

Note.  Fault  tolerant  software  is  generally  considered  to  refer  to  software  so  designed  to  continue  to  give  the  correct 
system  output  whilst  faults  exist  in  packs  of  the  software  and/or  associated  hardware. 

Author’s  Reply 

Fault  tolerant  software  was  illustrated  as  a  Software  System  that  could  enable  the  control  system  to  recontinue  after 
a  software  “glitch”  or  absurd  set  of  dynamic  conditions  that  were  not  evaluated  during  the  test  stage. 

The  fact  that  these  conditions  went  transiently  outside  the  design  limits  for  the  software  to  handle  in  its  allotted 
time,  should  not  necessarily  “freeze”  the  system  on  one  ocurrence.  If  they  continue  to  reappear  then  they  must  be 
regarded  as  a  more  fundamental  fault  and  different  criteria  applied. 

K.Smyth,  Ge 

Key  word.  Software  Development.  What  type  of  computer  language  is  used  in  the  software  development  phase? 
Any  higher  level  language? 

Author’s  Reply 

Assembly  language  is  used  for  the  control  tasks  in  all  cases.  For  some  software  modules  associated  for  example  with 
Health  Monitoring  and  data  transmission.  PLM  high  level  language  was  used. 
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Summary 

Modern  aircraft  turbine  engines  include  a  variety  of  control  actuators  which  affect  the  performance 
and  response  of  the  propulsion  plant.  The  incorporation  of  digital  processing  permits  integrated  control 
action  to  meet  strict  steady-state  and  transient  performance  requirements.  The  need  exists  for  a  control 
design  procedure  that  <~an  account  for  multiple  loop  interaction  and  can  make  efficient  use  of  them  to 
enhance  performance  \  .thout  decreasing  engine  stability  margins.  The  FIDO  Multivariable  Control  Synthesis 
Program  was  a  cooperative  effort  w>th  the  Air  Force  Aero  Propulsion  Laboratory  and  the  NASA  Lewis  Research 
Center  aimed  at  investigating  the  use  of  extended  linear  quadratic  synthesis  techniques  to  accomplish  the 
design,  evaluation  and  testing  of  a  practical  multivariable  control  for  the  F100  engine. 

A  digital,  multivariable  control  design  procedure  for  the  F100  turbofan  engine  is  described.  The 
controller  is  based  on  locally  linear  synthesis  techniques  using  linear,  quadratic  regulator  design  methods. 
The  control  structure  uses  an  explicit  model  reference  form  with  proportional  and  integral  feedback  near  a 
nominal  trajectory.  Modeling  issues,  design  procedures  for  the  control  law  and  the  estimation  of  poorly 
measured  variables  are  presented. 

The  multivariable  control  'raw  was  implemented  on  a  general  purpose  minicomputer  at  NASA  Lewis  Research 
Center.  The  logic  was  thoroughly  validated  against  explicit  design  and  operating  performance  criteria  on  a 
real  time  hybrid  simulation  of  the  engine  throughout  the  full  flight  envelope.  Alternate  control  modes, 
sensor  failure  sensitivities  and  other  design  features  were  investigated  using  the  hybrid  simulation. 

The  resulting  system  was  then  used  to  operate  an  actual  FIDO  engine  in  an  altitude  test  facility  at 
NASA  Lewis  Research  Center.-  In  all,  steady-state  and  transient  performance  were  investigated  at  five  (5) 
subsonic  and  four  (4)  supersonic  test  points.  The  results  of  these  experiments  and  correlation  to  the 
important  design  issues  are  presented. 
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Nomenclature 


=  trim  switching  matrix 
=  quadratic  state  weighting  matrix 
=  nozzle  area 

=  quadratic  control  weighting  matrix 
=  bill  of  material  (production)  control 
=  feedback  gain  matrix 
=  regulator  gain  matrix  (m  x  n) 

=  integral  gain  matrix  (m  x  r) 

=  linearized  measurement  matrix 
=  nonlinear  engine  model 
=  linearized  engine  dynamics  matrix 
-  linearized  measurement  matrix 
=  Hamiltonian  matrix 
=  nonlinear  measurement  function 
=  a  row  of  the  H  matrix 
=  number  of  states 
=  rotor  speed 
=  number  of  controls 
=  burner  pressure 

=  interturbine  volume  pressure 
=  augmentor  entrance  pressure 

=  number  of  outputs 
=  number  of  parameters 
=  number  of  possible  trim  variables 
=  steady-state  Ricatti  matrix 
=  state  transformation  matrix 
=  fan  ex’t  inner  temperature 


2.5C 


4HI 

T4L0 


4.5HI 

T4.5L0 


6C 

T7M 
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w 
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=  fan  exit  outer  temperature 
=  compressor  discharge  temperature 

=  high  turbine  inlet  temperature,  hi qh 
response 

=  high  turbine  inlet  temperature, 
response 

=  high  turbine  inlet  temperature,  local 

=  fan  turbine  inlet  temperature,  high 
response 

=  fan  turbine  inlet  temperature,  low  response 
=  fan  turbine  exit  temperature 
=  augmentor  entrance  temperature 
=  augmentor  exit  temperature 

=  m  x  1  control  vector 
=  n  x  1  state  vector 
=  p  x  1  output  vector 
=  m  x  1  control  reference  point  vector 

=  n  x  I  state  reference  point  vector 
=  p  x  1  output  reference  point  vector 

=  model  coordinate 
=  vector  of  parameters 
=  perturbation  quantity 
=  fan  exit  Mach  number  parameter 
=  block  diagonal  matrix 
-  mode)  control labi 1 ity  matrix 
=  eigenvalue 
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High-  -Lo* -pressure 


Figure  1 


Schematic  representation  of  F100-PW-100  augmented  turbofan  engine. 


Introduction 


Over  the  past  several  years,  aircraf*.  operational  requirements  have  dictated  the  development  of 
propulsion  systems  having  increased  performance  over  a  wider  operating  envelope.  To  satisfy  these 
performance  requirements,  variable  geometry  components  have  become  an  integral  part  of  advanced  aircraft 
engines.  Future  variable  cycle  engines  may  incorporate  variable  fan,  compressor,  turbine  and  exhaust 
nozzle  geometry  to  improve  overall  performance. (1)  As  a  result,  the  engine  control  system  will  have  to 
be  capable  of  controlling  engine  fuel  flows  and  the  variable  geometry  in  an  "optimum"  manner.  This  will 
necessitate  the  measurement  of  more  engine  variables.-  However,  the  multitude  of  variables  to  be  manipulated 
and  measurements  to  be  utilized  make  it  difficult  to  design  controls  for  these  advanced  engines. 

Classical  control  synthesis  techniques,  whicn  involve  the  analysis  and  design  of  single-input,  single¬ 
output  control  loops,  have  worked  quite  well  for  the  older,  simpler  engines.  Unfortunately,  such  techniques 
prove  to  be  cumbersome  and  time-consuming  when  they  are  applied  to  the  more  complex  multivariable  engines. 

One  approach  to  solving  the  engine  control  problem  is  the  use  of  multivariable  (optimal)  control  theory. 
The  Linear  Quadratic  Regulator  (LQR)  is  one  aspect  of  the  theory  that  has  been  successfully  developed  and 
applied  to  a  wide  variety  of  linear  multivariable  control  problems. (2)  LQR  designs  result  in  Feedback-type 
controllers  which  make  use  of  inherent  loop  interactions  to  improve  performance.  The  LQR  control  modes  can 
also  reduce  the  sensitivity  to  parameter  variations  and  sensor  inaccuracies. 

The  F100  Multivariable  Control  Synthesis  (MVCS)  Program^3,4,5)  was  a  jointly  sponsored  Air  Force  Aero 
Propulsion  Laboratory-NASA  Lewis  Research  Center  program  designed  to  investigate  the  use  of  Linear  Quadratic 
Regulator  (LQR)  theory  to  the  design  of  a  practical  control  for  an  advanced  state-of-the-art  turbofan  engine. 
There  have  been  some  initial  research  and  development  efforts  made  at.  applying  LQR  theory  to  the  design  of 
controls  for  the  nonlinear,  gas  turbine  engine  process. (6-10)  These  efforts,  however,  have  been  limited  to 
engine  control  over  a  narrow  operating  range  (usually  sea  level,  static,  standard-day  conditions).  The  MVCS 
program  differs  from  previous  studies  in  that  it  addresses  the  following  issues:  (1)  the  ability  to  accom¬ 
plish  large  power  excursions  without  exceeding  engine  or  actuator  limits,  (2)  the  extension  of  the  controller 
authority  to  the  entire  engine  operating  envelope,  (3)  the  consideration  of  sensor  and  actuator  nonlineari¬ 
ties  in  the  design  process,  and  (4)  the  validation  of  the  control  performance  in  real  time. 

Tne  F 1 00  (see  Figure  1)  engine  was  selected  for  the  MVCS  program  due  to  the  availability  of  detailed 
digital  and  hybrid  computer  simulations  of  that  engine  and  the  availability  of  an  actual  F100  engine  for 
testing  at  NASA  Lewis  Research  Center.  The  F T 00  engine  represents  the  current  state-of-the-art  in  aircraft 
gas  turbine  technology.  Although  not  as  complex  as  some  of  the  advanced  cycles  being  proposed,  the  F100  does 
provide  a  suitable  test  for  the  LQR  technique.  In  addition  to  the  main  burner  and  afterburner  fuel  flows, 
the  F100  has  variable  fan  inlet  guide  vanes,  variable  compressor  stator  vanes  and  a  variable  convergent- 
divergent  exhaust  nozzle.  Airflow  bleed  can  be  extracted  at  the  compressor  exit. 

Certain  restrictions  were  placed  on  the  control  design.  The  design  approach  would  use  linear  engine 
models  as  a  basis  for  the  control  synthesis.  Deterministic  LQR  theory  was  to  be  applied  exclusively,  i.e., 
as  a  first  approximation,  the  random  uncertainty  associated  with  the  engine  behavior  was  assumed  to  be 
negligible.  Only  existing  sensed  variables  were  to  be  used  as  control  inputs.  The  controller  authority  was 
to  include  engine  operation  from  idle  to  max  dry  power.  Start-up  and  afterburner  regimes  were  excluded; 
however,  during  the  hybrid  simulation  and  engine  tests,  afterburner  lights  were  done  to  assess  the 
controller's  regulation  capability  in  the  presence  of  disturbances. 

Prior  to  the  actual  control  design,  detailed  criteria  were  established  that  specified  the  desired  engine 
performance. (3)  The  control  criteria  can  be  summarized  as  follows.  Foremost,  the  control  must  protect  the 
engine  against  surge  and  from  exceeding  speed,  temperature  and  pressure  limits.  Airframe-engine-inlet  compat¬ 
ibility  requirements  specify  minimum  burner  pressure  limits  and  maximum  and  minimum  airflow  limits  at  certain 
flight  conditions.  The  control  must  insure  engine  thrust  and  fuel  consumption  are  within  tolerance  for 
specified  engine  degradations  and  for  installation  effects.  The  engine  must  also  accelerate  and  decelerate 
smoothly,  safely,  quickly  and  repeatably  with  small  overshoots  allowable.lt  must  do  this  for  both  large  and 
small  requested  power  level  movements  and  during  flight  maneuvers. 
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Theoretical  Synthesis  Method 

The  fundamental  aspects  of  locally  linear  control  synthesis  are  reviewed  as  applied  to  the  synthesis  of 
the  control  and  the  fundamental  requirements  of  the  control  structure.  The  engine  may  be  modeled  conceptually 
as  a  nonlinear  time-invariant  dynamical  system  utilizing  fundamental  aerodynamic  principles  as  follows: 


X  =  f(x,u,6) 

(i) 

y  =  h(x,u,6) 

(2) 

where  n  states,  x,  m  controls,  u,p  outputs,  y,  and  q  parametric  variables  6,  as  well  as  the  detailed  nonlinear 
dynamics  f(.,.,.)  and  measurements  h(. are  modeled  by  the  designer  to  achieve  his  purpose  most 
expediently.  For  engine  development,  detailed  digital  simulations,  including  thorough  component  maps  and 
experimentally  correlated  gas  pat'i  equations,  are  utilized  as  in  the  FIDO  transient  simulation  deck.  These 
programs  are  too  complex  for  control  synthesis,  but  are  useful  in  evaluating  a  candidate  design. 

(31 

Locally  linear  models  can  be  generated  from  nonlinear  simulations'  '  or  experimentally  from  engine  data 
via  system  identification,  e.g.,  Ref.  11.  These  models  are  valid  in  the  neighborhood  of  an  equilibrum  point 
^o’VV  and  descr,it5e  perturbation  motion  6x,5u,  away  from  equilibrium.  These  models  are  represented  as 

follows: 


<$x  =  F6x  +  G<$u 
6y  -  H<5x  +  D6u 
where,  in  principle. 


F  = 


3f(x,u0,e0) 


3x 


x=x„ 


fix  and  6u  will  be  rewritten  as  x. 


u  in  the  remainder  of  this  paper. 


(3) 

(4) 
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Figure  2  -  Schematic  Flow  Diagram  of  FIDO  Nonlinear  Digital  Simulation. 


Figure  3  -  States,  Outputs  and  Controls  Modeled  in  F100  Linear  Equations  Generated 

from  Nonlinear  Digital  Simulation  Program. 


10-4 

Figure  2  shows  a  schematic  representation  of  the  F100  digital  transient  simulation.  Each  dynamical 
element  represents  two  or  more  states,  and  the  entire  linear  model  contains  16  state  elements  (Fig.  3).  The 
linear  model  can  be  reduced  in  order  to  include  only  practically  measurable  elements  and  only  important 
dynamics  relative  to  the  control  objective. 
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where  and  z^  are  the  qth-order  partition  of  states  and  modes  and  x2  and  z2  are  the  (n  -  q)th-order 
partition. 

Various  guidelines  for  making  the  appropriate  partition  will  be  discussed  below,  in  which  case  the 
following  equilibration  relation  can  be  attained  approximately  within  the  time  frame  of  interest: 

z2  =  0  (8) 

If  relation  (8)  is  valid,  the  following  relations  hold: 

*1  =  Frxl  +  Gru  (9) 
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The  formula  for  the  reduced  matrices  follow  from  elementary  matrix  algebra. (12) 

Thus,  by  assuming  that  (n  -  q)  modes  are  equilibrated,  the  nth  order  system  (3)  is  reduced  to  the  qth- 


order  system  (9)  with  q  states  and  p  +  n  -q  outputs.  It  should  be  noted  also  that  the  q  retained  states  x 
are  chosen  by  the  designer  (13)  and  possess  the  same  physical  identification  in  Eqs.  3  and  9  as  long 
as  Eq.  8  is  approximately  valid. 


The  partitioning  of  the  system  is  dependent  upon  the  control  designer's  estimate  of  the  frequency  range 
of  the  control  function.  For  example,  this  F100  controller  was  designed  primarily  to  modulate  thrust  in 
transient  and  steady-state  operation.  The  response  frequency  range  extends  from  0  to  about  10  rad/s,  which 
is  the  bandwidth  of  the  primary  (fuel  flow)  actuator.  The  frequency  range  would  be  significantly  different 
if,  for  example,  the  controller  were  designed  to  modulate  compressor  s  irge  margin  with  a  high-bandwidth, 
variable-area  turbine  actuator.  The  implication  is  that  all  eigenvalues  significantly  outside  the  bandwidth 
of  interest  are  in  equilibrium  during  the  motion  and  may  be  partitioned  with  the  (n  -  q)  eliminated  roots. 

A  special  situation  occurs  when  a  state  is  nearly  parallel  to  a  single  modal  direction.  If  the  outputs 
are  not  affected  significantly  by  the  particular  element,  then  the  state  and  associated  dynamics  can  be 
removed  from  the  design  model  without  affecting  behavioi  important  to  the  control  synthesis.  Figure  4  shows 
the  normalized  eigenvectors  associated  with  two  eigenvalues  for  the  F100  engine  lying  in  the  bandwidth  of 
control,  ihese  modes  are  associated  with  temperature  lag  states  at  the  turbine  inlets.  Examination  of  the 
thrust  output  equation  shows  that  these  states  have  a  relatively  small  contribution.  Thus,  for  control 
design  purposes,  the  two  states  and  the  associated  modes  can  be  eliminated. 

We  have  shown  a  number  of  techniques  for  choosing  (n  -  q)  modes  that  can  be  eliminated,  along  with  a 
group  of  states.  The  choice  of  the  retained  q  states  is  somewhat  arbitrary,  depending  on  convenient 
measurables  as  well  as  the  dependence  of  important  output  quantities.  The  modal  decomposition  can  be  used 
to  assure  that  the  chosen  q  states  strongly  span  the  controlled  subspace  (T,,  invertible  and  well  condi¬ 
tioned).  With  this  partition  and  associated  reduction,  the  resulting  system  will  represent  a  controllable 
design  model . 


fAN  SPEEO  (I  DESIGN)  HIGH  ROTOR  SPEED  (J  DESIGN) 
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Figurs  4  -  Normalized  Eigenvector  Components  for  Two  Roots  Lying  in  the  Bandwidth 
of  Control  at  Sea  Level  Static,  Intermediate  Power  Condition  for  the 
F100  Turbofan  Engine. 


For  the  F100,  the  behavior  of  the  design  model  vis-a-vis  the  sixteenth-order  linear  system  and  nonlinear 
simulation  is  shown  in  Figure  5.  The  reduction  was  performed  on  the  linear  system  equations  in  each  region 
of  the  operating  envelope  to  provide  a  set  of  models  used  in  the  optimal  regulator  synthesis.  The 
total  procedure  to  arrive  most  efficiently  at  multivariable  designs  requires  the  utilization  of  a  ulend  of 
techniques  incorporating  frequency  and  time  domain  analysis  and  modern  and  classical  control  concepts 


Figure  5  -  Comparison  of  Small  Perturbation  Response  of  the  F100  Turbofan  Engine 
at  Sea  Level  Static,  Taxe-off  Power  Simulated  by  the  Full  Nonlinear 
Tigital  Deck,  the  16th-0rder  Linearized  Model  and  the  Reduced  Order 
Design  Linear  Model. 
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Given  the  linear  design  model  (Eq.  9),  and  the  state/control  performance  index, 

J  =  \  (xT  Ax  +  uT  Bu)dt  (11) 

or  the  output  performance  index, 

J  =  \  /0“  (yT  A*  y)dt  (12) 

the  deterministic,  steady-state  optimal  controller  to  minimize  J  for  arbitrary  initial  conditions  about  a 
fixed  set  point  is  given  by  the  following  state  variable  regulator  control  law: 

u  =  uQ  +  C(x  -  xQ)  (13) 

C  =  -B'Vs  (14) 

where  u  ,  x  are  a  consistent  equilibrium  reference  point  for  the  nonlinear  plant,  namely, 

0  »  f(x0,u0)  (15) 

where  f[x(t),u(t)]  describes  the  nonlinear  engine  behavior  exactly.  The  matrix  S  is  given  by  the  positive 
definite  solution  of  the  algebraic  Ricatti  equation  (for  Eq.  11) 

0  =  SF  +  FTS  +  A  -  SGB-1  GTS  (16) 


and  by  a  comparable  form  for  Eq.  12.  The  solution  is  calculated  numerically  by  integration  of  the  matrix 
R’ccati  differential  equation  to  steady-state  or,  more  efficiently,  bv  the  eigenvector  decomposition 
method. (14)  The  optimality  of  such  regulators  is  given  in  terms  of  a  fixed  set  point.  However,  with 
reasonable  choices  of  weighing  parameters,  system  response  is  not  degraded  for  varying  set-point  inputs. 

The  state  or  output  weightings  can  be  constructed  initially  from  physical  reasoning.  Alternately,  if 
it  is  desired  to  alter  the  dynamic  response  in  terms  of  time  domain  specifications  (e.g . ,  rise  time  or 
damping),  state  weightings  on  the  variables  most  nearly  associated  with  the  mode  to  be  controlled  are 
chosen.  State  variables  and  output  quantities  often  are  related  physically.  Control  of  the  state  is  then 
equivalent  to  control  of  the  output.  In  this  case,  the  need  for  explicit  output  weighting  is  removed.  For 
example,  engine  thrust,  an  output  and  augmentor  pressure,  a  state,  have  nearly  the  same  coefficient 
representation.  Thus,  weighting  Pgg  results  in  direct  control  of  thrust  response.  Such  considerations  can 

give  the  designer  a  foundation  for  the  initial  quadratic  weighting  matrix  selection. 

If  a  number  of  control  requirements  are  represented  in  the  performance  index  simultaneously,  it  is 
probable  that  the  initial  design  will  be  unacceptable  in  some  way.  Often,  the  unacceptable  nature  of  the 
behavior  can  be  linked  directly  to  a  particular  closed-loop  root  and  modal  response  vector.  Tor  example, 
thrust  overshoot  can  be  linked  to  a  Ptg  -N,  complex  pair  in  the  closed-loop  root  cancellation,  as  determined 

by  an  examination  of  the  eigensystem.  It  is  clear  that  the  weights  on  either  N,  or  .  tg  or  both  must  be 

adjusted  so  that  the  damping  is  increased.  Sensitivities  of  the  closed-loop  locations  to  changes  in  weighting 
matrix  elements  can  be  calculated  from  decomposition  of  the  Euler-tagrange  system  used  to  solve  the  algebra 
Riccati  equation. (15)  For  the  decomposition, 

HT  =  TA  (17) 

with  A  diagonal  and  H  the  dynamics  of  the  Euler-lagrange  system;  it  can  be  shown  ( 1 5 J  tnat 

3A  T-1  3H  T  (18) 

30,  36, 

where, 

I,  •  ««  "9l 

is  the  sensitivity  of  the  eigenvalue  location  to  a  change  in  the  weighting.  The  matrix  3H/30  normally 
consists  of  1 1 s  and  Q‘s,  and  the  similarity  transformation  is  available  from  the  optimal  controller  solution. 
Utilizing  Eq.  18,  the  correct  weight  changes  to  alter  the  closed-loop  pole  locations  is  evaluated  easily. 
Successive  use  of  model  weighting  sensitivity  and  time  domain  simulation  will  result  in  the  quick  convergence 
to  a  design  with  acceptable  regulator  performance. 


Functional  Description  of  the  Controller 

Figure  6  shows  a  schematic  representation  of  the  digital  controller.  The  control  structure  is  applicable 
to  many  physical,  nonlinear  systems  with  state,  control  and  output  constraints.  Each  functional  component 
of  the  system  produces  an  element  of  the  control  law.  The  multivariable  control  law  is  expressed  by  Eq.  20. 

u  =  u$  +  Cx(x  -  xs)  +  /  Cy  A (y  -  ys)dt  (20) 

The  feedback  law  itself  rep.esents  an  optimal  regulator  structure  with  integral  trims  tor  steady-state 
accuracy  and  a  model  following  implementation  to  prevent  saturation  during  transients.  Each  element  of  the 
control  law  will  be  described  relative  to  the  FI 00  implementation,  and  the  synthesis  procedure  for  each 
block  will  be  reviewed  briefly. 


10-7 


Reference  Value  Generator 


The  control  law  is  written  for  state  and  control  perturbations  about  an  equilibrium  condition.  The 
equilibrium  conditions  must  be  derived  approximately  by  the  controller  given  the  requested  power  level, 
altitude,  Mach  number,  engine  face  pressure  and  temperature.  Because  of  manufacturing  tolerances  and  engine 
aging,  an  exact  expression  for  these  quantities  is  not  possible.  Inaccuracies  in  the  scheduled  reference 
values  normally  would  cause  steady- state  "hang-offs"  unless  compensated  with  an  integral  trim  action.  Small 
inaccuracies  do  not  degrade  transient  performance,  and  indeed,  the  feedforward  structure  allows  lowt-.>' 
regulator  feedback  gains  and  the  associated  model  parameter  insensitivity  of  the  control. 

The  reference  schedules  are  produced  by  calculating  the  thermodynamic  equilibrium  associated  with  a 
given  control  vector.  The  manufacturer-specified  steady-state  condition  requires  zero  bleed  flow  and 
scheduled  compressor  geometry.  Two  degrees  of  freedom  are  left  to  attain  desired  thrust  (power  level)  at 
a  particularfl  ight  point.  The  reference  point  generator  attempts  tc  set  a  fan  matchpoint  to  achieve 
equilibrium.  The  current  control  mode  is  to  specify  the  fan  matchpoint  using  fan  rotor  speed  and  fan  exit 
Mach  number  (Ap/p). 

A  constrained  minimization  can  be  performed  to  determine  the  required  fuel  flow  and  and  jet  area  to 
achieve  requested  thrust  while  optimizing  a  free  variable,  e.g.,  fuel  consumption  or  surge  margin,  and 
respecting  all  engine  structural  limits.  For  comparison  purposes  in  the  F100  controller,  schedules  were 
generated  to  match  the  production  control  operating  point  at  each  power  level  and  flight  point. 

A  representative  group  of  subsonic  and  supersonic  flight  points  was  chosen,  and  the  engine  equilibrium 
points  were  calculated.  Nondimensionalized  quantities  were  utilized  to  fit  approximate  reference  points 
with  minimum  complexity.  The  regulator  is  tolerant  of  the  schedule  errors  and  produces  smooth  transient 
responses  without  an  overly  complex  implementation. 


Transition  Model 


When  a  large  transition  in  power  is  requested  by  the  pilot,  the  perturbation  character  assumed  in  the 
regulator  design  is  lost.  A  large  change  in  the  reference  state  vector  will  cause  large  commanded  inputs, 
tending  to  saturate  actuators  and  produce  significantly  nonlinear  behavior.  The  regulator  can  be  used  to 
track  a  compatible  trajectory  taking  the  system  for  one  state  to  another.  Exact  calculation  of  such 
trajectories  is  complex, (16)  and  their  practical  implementation  has  not  been  investigated.  A  first-order 
approximation  to  an  achievable  state  trajectory  can  be  calculated  directly  from  the  linearized  model, 

(Eqs.  3  and  4).  In  this  case,  it  is  assumed  that 

X  =  Rx  =  constant  (21 ) 

and,  allowing  for  various  controllability  constraints,  a  consistent  set  of  equilibrium  state  and  control 

rates  R  ,  R  can  be  calculated  if  a  particular  set  of  output  rates  is  specified.  The  nonlinear  trajectory 
x  y 

(x  (t),  us(t))  then  is  approximated  as  follows: 

*s^  =  VV  +  Rxt 
°s(t)  =  us(V  +  V 


(23) 
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where  the  transition  is  terminated  when  the  new  reference  point  is  reached.  The  rates  are  derived  from 
parametric  fits  of  values  calculated  at  each  flight/power  point.  Figure  7  is  a  schematic  diagram  of  the 
transition  control  logic. 


Figure  7  -  Transition  Trajectory  Generation  Algorithm  is  Formed  from  a  Rate 

Limited  Servomechanism  Structure  With  Variable  Rate  Saturation  Forming 
the  Gross  Trajectory  and  the  Proportional  Response  Providing  Continuity 
with  the  Steady-State  Reference. 


Notice  that  the  term  u  from  the  trajectory  generator  is  a  feedforward  control  command  in  the  control 
law  of  Equation  20.  This  feedforward  feature  produces  rapid  and  smooth  accelerations  and  decelerations 
without  the  need  for  high  gain  integrators.  This  is  a  highly  desirable  feature  as  integrators  have  a 
destabilizing  effect  on  any  system. 


In  the  F100  implementation,  rates  were  calculated  for  low,  middle  and  high  power.  In  the  latter  two 
cases,  desired  thrust  and  turbine  inlet  temperature  rates  characteristic  of  the  engine  were  chosen.  At  low 
power,  thrust  and  either  burner  pressure  or  surge  margin  rates  were  specified,  depending  on  the  flight 
condition,  in  order  to  specify  adequate  acceleration  surge  margin  or  eliminate  burner  pressure  undershoot. 
Figure  8  shows  the  response  of  the  nonlinear  digital  simulation  to  a  large-power- level  modulation.  Engine 
state  and  trajectory  time  histories  are  shown,  along  with  error  terms  in  the  regulator  portion  of  the  control 
law.  The  transition  model  prevents  large  error  terms  from  saturating  actuators  during  gross  transients  while 
still  providing  stiff  regulation  near  steady-state  conditions.  The  implementation  of  this  type  of  transition 
algorithm  requires  very  little  control  logic  and  storage.  The  performance  is  excellent  and  the  processing 
overhead  is  minimal. 


Figure  8 


Illustration  of  Transient  Trajectory  Generation  Algorithm  for  Cyclic  PLA 
Input  at  Sea  Level  Static  Conditions  from  Nonlinear  Digital  Simulation. 
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Gain  Schedule 

The  dynamic  response  of  the  engine  is  affected  strongly  by  the  air  mass  flow.  Power  level,  altitude 
and  Mach  number  determine  this  mass  flow  and  the  response.  The  linearized  control  synthesis  (LQR)  procedure 
produces  regulator  gains  that  control  the  engine  satisfactorily  in  the  neighborhood  of  the  design  flight/power 
point.  To  implement  a  continuous  envelope-wide  controller,  the  gains  must  be  varied  as  the  system  makes  the 
transition  from  one  condition  to  another. 

There  is  no  precise  analytical  relationship  between  gains  at  neighboring  linearization  points.  Although 
engine  time  constants  can  be  modeled  as  functions  of  the  ambient  conditions,  the  performance  index  is  chosen 
by  the  designer  to  satisfy  specifications  particular  to  the  flight  point.  For  example,  a  function  of  ambient 
variables  will  not  correlate  exactly  the  gain  elements  between  sea  level  static  idle  conditions,  where  thrust 
stability  is  weighted  heavily,  and  subsonic  altitude  idle,  where  burner  pressure  is  the  dominant  state  weight. 
The  procedure  adopted  f„r  the  FI 00  implementation  approximately  fit  important  gain  elements  with  univariate 
functions  of  the  engine  face  density  and  rotor  speed.  The  former  variable  accounts  for  altitude  effects, 
while  the  latter  schedules  the  power  condition.  Dominant  gain  elements  are  determined  by  assessing  the 
closed-loop  eigenvalue  sensitivity  of  the  system  to  each  gain  element  (17)  and  eliminating  those  that  do  not 
affect  closed-loop  response.  Over  50  percent  ot  the  scheduled  control  gains,  C  and  C  ,  were  eliminated 
in  the  final  implementation  with  little  or  no  effect  on  system  performance.  y 


Integral  Switching 


The  design  philosophy  of  aircraft  turbine  engines  dictates  that  steady-state  performance  is  obtained 
at  various  flight  conditions  when  a  particular  physical  limit  is  held  exactly  (see  Figure  9).  For  example, 
sea  level  static  take  off  thrust  for  the  FI 00  is  defined  as  the  thrust  obtained  at  the  maximum  allowable 
turbine  inlet  temperature.  At  lower  power  levels,  the  engine  operation  should  cause  the  airflow  and  low 
rotor  speed  to  attain  predetermined  values  for  optimum  efficiency.  At  altitude  conditions,  the  minimum 
burner  pressure  defines  engine  idle.  Inlet  airflow  requirements  and  burner  burst  pressure  determine 
operating  conditions  at  some  supersonic,  flight  points. 
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Figure  9  -  Operating  Envelope  Constraint  Limits  for  the  F100  Turbofan  Engine 


The  engine  set-point  is  a  group  of  reference  vqlues  of  states  ard  controls  which  the  engine  must 
attain  exactly  in  steady-state.  These  values  defiqe  the  equilibrium  point.  Since  the  F100  has  set-point 
vectors  whose  elements  change  with  flight  and  power  conditions,  a  swuching  structure  from  trim  control 
is  required 

Giver  the  design  model  (Eq.  3)  and  the  linear  quadratic  regulator  design  (Eq.  13),  the  closed-loop 
response  to  additive  control  inputs  may  be  written  as  follows: 

X  --  (F  +  GCX)  x  +  r,.j‘  (24) 


where 


u  =  Cxx  +  u 


(25) 
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and  u  is  the  additional  control  input.  If  the  trim  responses  (i.e.,  the  integral  control  time  constants) 
are  decoupled  spectrally  from  the  transient  equations,  i.e.,  time  constants  of  Eq.  24,  then  the  following 
should  be  approximately  valid: 


x  =  -(F  +  GCxpGu 

y  =  C  -(H  +  DCX)(F  +  GCX)  _1G  +  0]  u'  (28) 

or,  y  =  H*u'  (29) 

The  output  vector  y  is  chosen  as  m  quantities,  which  must  be  held  in  steady-state  to  their  reference 
values.  (Controllability  is  assured,  then,  if  H*  is  invertible.)  The  trim  integrations  provide  system 
dynamics,  namely, 


The  control  law  is  designed: 
u'  =  Cyb 

and  the  full  controller  i"  ' 


"'anted: 


u  =  Cxx  +  /  Cyydt 

where  elements  of  y  and  Cy  can  be  switched  arbitrarily  while  maintaining  a  continuous  control  time  history. 

The  design  of  the  control  law  C  could  be  performed  with  a  single  application  of  the  regulator  synthesis 
procedure.  However,  because  the  elements  of  the  y  vector  change  according  to  limit  conditions  and  control 
saturations,  a  complete  design  for  all  combinations  of  error  vectors  would  require  an  extremely  large  number 
of  Cy  matrices  stored  in  the  controller. 

The  classical  approach  is  to  ignore  various  couplings  in  H*,  and  the  integral  control  can  be  designed 
on  a  loop-by-loop  basis.  For  each  output, 

bi  =  h.*Tu 


if  control  weightings  are  chosen  to  represent  the  amount  of  control  u-  which  should  be  used  to  trim  the 
outpu  error  y.  as  follows:  Jmax 

»jj  ■  ,/(vL  (*> 

then  the  optimal  single-loop  output  regulator  can  be  designed  to  place  the  spectrally  separated  trim  root 
at  s  =  -X.  The  gain  for  this  system  is 

Cyi  =  -XB',h1.*/hi*TB"1h.*  (35> 

The  full  gain  matrix  Cy  is  constructed  as  follows: 


Cy  =  [Cyl  Cy2 


• -  -  Cyr^ 


where  columns  are  chosen  corresponding  to  the  appropriate  set-point  and  number  of  unsaturated  controls. 
Equation  36  represents  a  single  matrix  that  can  accommodate  any  subset  of  output  errors  as  long  as  a 
suitable  set  of  actuators  is  available.  The  drawback  of  such  a  procedure  is  that  the  precise  eigenvalue 
location  of  the  trim  root  system  is  determined  only  approximately  because  of  the  neglected  cross-couplings 
in  Eq.  29.  The  problem  can  be  minimized  if  the  weightings  are  chosen  (Eq.  34)  such  that  each  control  is 
used  primarily  to  modulate  a  single  output  error.  The  closed-loop  eigensystem  must  be  determined  to  verify 
suitable  root  locations  for  the  trim  and  transient  system  combined.  Further  iterations  may  be  required. 

Alternately,  if  the  closed-loop  trim  system 


b  =  H*Cyb  (37) 

is  chosen  such  the  H*C  is  upper  triangular,  then  any  row  and  column  of  C  can  be  deleted  without  altering 
the  remaining  closed-loop  dynamics.  Also,  it  is  possible  to  replace  a  single  row  of  Eq.  37  arbitrarily 
without  affecting  the  remaining  dynamics.  The  upper  triangular  structure  and  eigenvalue  placement  determined 
(m)(m  +  l)/2  constraint  equations.  The  remaining  (m)  (m  -  l)/2  free  elements  of  Cy  can  be  chosen  as  zero,  or 

a  quadratic  regulator  construction  in  Eq.  35  can  be  used  to  resolve  the  ambiguity. 

Either  method  just  described  produces  a  single  m  x  r  gain  matrix,  where  r  is  the  total  number  of  possible 
output  quantities.  If  1  controls  are  saturated,  m-1  elements  of  the  r  output  quantities  can  be  chosen  for 
trim.  The  control  law  then  is  implemented  as  in  Eq.  32,  with  the  1  rows  corresponding  to  the  saturated 
actuators  deleted  from  the  matrix.  The  control  is  switched  when  an  actuator  saturates  (delete  a  row  and 
column),  an  engine  limit  must  be  accommodated  (a  column  is  replaced),  or  the  error  term  associated  with  the 
saturated  control  will  tend  to  unsaturate  the  control  (add  the  row  and  column).  The  implementation 
produces  an  extremely  simple  structure  for  trim  and  trans.ent  control  action  which  can  accommodate  various 
engine  limits  and  control  saturation,  as  well  as  obtain  rated  engine  performance  accurately  throughout  the 
envelope. 


In  the  F100  implementation,  the  steady-state  requirements  are  to  have  the  compressor  bleeds  closed, 
vanes  and  stators  tracking  the  optimum  comoonent  efficiency  schedules,  and  fuel  flow  and  jet  area  adjusted 
to  yield  operating  line  performance  without  limit  exceedence.  Three  elements  of  the  set-point  vector  are 
the  vane,  stator  and  bleed  schedules.  These  error  terms  always  are  integrated  unless  they  are  driven 
transiently  into  saturation.  To  avoid  integrator  wind-up  due  to  this  uncontrollable  situation,  the 
appropriate  error  is  switched  out  until  the  transient  command  tends  to  cause  the  control  to  unsaturate. 

The  remaining  two  elements  of  the  set-point  are  normally,  scheduled  low  rotor  speed  and  an  averaged 
fan  exit  total  to  static  pressure  difference  Ap/p.  The  Ap/p  error  term  is  eliminated  if  the  jet  area 
saturates.  If  burner  pressure  or  turbine  inlet  temperature  limits  are  reached,  these  terms  are  substituted 
for  low  rotor  speed  in  the  control  law.  The  switching  logic  provides  smooth  and  controlled  engine  transitions 
in  power  and  flight  condition. 


Engine  Protection 

The  engine  protection  logic  in  the  multivariable  control  provides  hard  limits  on  the  commands  to  the 
control  actuators.  The  engine  protection  logic  includes  fuel  flow  limits,  variable  vane  limits,  bleed  air 
limits  and  exhaust  nozzle  area  limits.  The  fuel  flow  limits  include  the  maximum  and  minimum  fuel  flow  and 
an  acceleration  schedule,  which  is  a  function  of  measured  compressor  speed.  Axial  and  cambered  limits  are 
imposed  on  the  variable  vane  position.  The  maximum  and  minimum  nozzle  area  limits  are  scheduled  as  a  function 
of  power  lever  angle.  The  maximum  and  minimum  allowable  area  commands  converge  at  idle  power  so  as  to 
prevent  limit  cycling  in  this  operating  region.  Whenever  a  commanded  actuator  positi  .n  exceeds  a  specified 
limit  or  when  a  control  saturation  is  detected,  a  flag  is  set  with  the  control  logic.  These  flags  send  a 
signal  within  the  logic  to  clamp  and  hold  the  appropriate  trim  integrator  to  prevent  integrator  wind-up. 


FTIT  Estimator 


As  specified  by  the  manufacturer,  temperature  limiting  during  transient  and  steady-state  operation 
is  a  critical  function  of  any  turbine  engine  control  system. (3)  For  the  F100,  the  maximum  temperatures 
specified  for  compressor  discharge  and  turbine  inlet  stations  in  the  gas  path  are  implicitly  limited  by 
the  maximum  fan  turbine  inlet  temperature  (FTIT),  Accurate  measurement  of  FTIT  near  the  temperature  limiting 
region,  then,  is  absolutely  necessary  for  successful  engine  control.  Unfortunately,  the  FTIT  sensor  output 
response  is  extremely  slow  relative  to  the  temperature  overshoot  criteria.  Compensation  of  this  signal  is 
required  for  adequate  temperature  limiting  during  transient  maneuvers.  The  compensation  technique  must  not 
degrade  the  high  d.c.  accuracy  of  the  signal  because  this  measurement  sets  intermediate  thrust  at  a  majority 
of  flight  points. 

A  steady-state,  third-order  filter  was  designed.  The  FTIT  "estimator"  uses  a  combination  of  the  sensed 
FTIT,  the  steady-state  reference  value  of  FTIT,  the  transition  value  of  fuel  flow  and  the  commanded  fuel 
flow  to  predict  the  final  value  of  FTIT  during  a  transient.  The  predicted  FTIT  is  then  compared  to  the 
maximum  allowable  FTIT.  If  the  overtemperature  is  predicted,  the  fuel  flow  integrator  begins  downtrirming 
fuel  flow  before  an  actual  overtemperature  can  occur. 

Tne  FTIT  sensor  output  is  attenuated  at  high  frequencies  within  the  filter.  The  steady-state  gain  of  the 
estimator  to  the  sensed  input  is  unity,  preserving  the  high  d.c.  accuracy  of  the  measurement.  The  two 
fuel  inputs  are  used  to  provide  the  initial  high  frequency  response  compensation  of  the  sensed  temperature. 

The  estimator  functions  as  a  complementary  f 'Iter  in  blending  inputs  of  two  types  to  form  a  system  with 
acceptable  response  and  accuracy. 


An  example  of  the  performance  of  the  estimator  is  shown  in  Figure  10.  The  overshoot  occurs  in  advance 
of  the  actual  FTIT  response.  This  enables  tne  controller  to  use  the  estimator  ouiDut  to  modulate  the 
controls  to  reduce  actual  temperature  overshoots.  Whenever  an  acceleration  occurs  that  will  not  cause  a 
temperature  limit  to  be  exceeded,  the  estimator  output  is  not  used  to  throttle  back  fuel  flow.  Thus, 
off-intermediate  power  accelerations  a^e  not  penalized  by  the  temperature  limiting  logic. 


Figure  10  -  Example  of  Temperature  Compensation 
Showing  Compensator  Output  Leading 
Doth  the  Actual  Temperature  Response 
and  Sensor  Output  During  a  75» 

Thrust  Step  at  10,000  ft,  Mach 
Number  0.9  from  Hybrid  Simulation. 
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Hybrid  Evaluation  Results 

Initially,  the  control  logic  was  validated  on  the  F100  digital  simulation. (18)  During  these  tests, 
small  transient  responces  were  run  to  verify  the  steady-state  regulatory  performance.  Large  power  lever 
transients  were  run  to  test  the  limit  protection  logic  and  the  transition  controller.  Disturbances  were 
generated  to  investigate  the  effects  of  augmentor  ignition  and  inlet  distortion,  utilizing  the  unique 
flexibility  offered  by  the  digital  simulation,  accelerations  at  sea  level  static  conditions  with  severe 
engine  deterioration  and  power  extractions  were  done  to  test  the  control  in  this  critical  region.  The 
digital  evaluation  provided  a  preliminary  test  of  the  logic  at  a  limited  set  of  flight  conditions  to  vali¬ 
date  the  design  and  structure  of  tfr  control  logic. 


The  F100  multivariable  control  logic  was  then  implemented  on  a  SEL810B  digital  computer  and  evaluated 
on  a  hybrid  computer  simulation  of  the  F100  engine(19)  at  the  NASA  Lewis  Research  Center.  The  SEL810B  is 
a  general  purpose  computer  processor,  and  although  not  flight  qualified  hardware,  its  memory,  speed  and 
word  size  are  believed  to  be  representative  of  computers  that  will  be  used  to  control  engines  in  the  1 980 ' s . 
Figure  11  is  a  schematic  of  the  hybrid  system.  The  primary  objective  of  the  hybrid  evaluation  was  to  verify 
the  multivariable  control  logic  and  its  implementation  to  ensure  safe  and  stable  operation  of  the  F100  engine 
during  subsequent  iltitude  tests.  The  results  of  the  evaluation  indicated  that  the  control  logic  and  its 
implementation  will  be  capable  of  controlling  the  engine  throughout  its  operating  y,ange.  The  specified 
engine  limits  were  not  violated  during  normal  steady-state  and  transient  operation. 
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Figure  11  -  Schematic  Representation  of  the  Multivariable  Control  Evaluation  Configuration. 


The  evaluation  flight  condition  (altitude/Mach  number)  and  the  types  of  tests  conducted  are  listed  in 
Table  I.  In  all,  56  steady-state  operating  points  were  recorded  and  77  transient  tests  were  performed  during 
the  hybrid  evaluation. 

The  multivariable  control  matched  baseline,  steady-state  performance  for  all  but  a  few  supersonic  test 
cent1 cions.  The  degraded  supersonic  performance  was  attributed  to  reference  point  scheduling  errors  at  those 
conditions.  Minor  modifications  to  the  reference  point  schedules  will  produce  satisfactory  steady-state 
performance  at  all  flight  conditions.  The  proportional  (LQR)  plus  integral  control  structure  provided  good 
fan  operating  point  control  and  when  required,  tracked  the  engine  limits. 

The  LQR  and  transition  control  produced  satisfactory  transient  responses  at  most  operating  conditions. 
The  specified  response  time  requirements  were  satisfied  for  all  small  and  large  amplitude  transients  with  the 
exception  of  the  small  (+3°)  PLA  snaps  at  the  sea  level/static,  idle  condition.  A  1.2  second  response  time 
requirement  for  the  small  perturbations  was  adopted  due  to  a  lack  of  specificity  in  the  design  criteria. 

The  flexibility  of  the  control  structure  and  design  methods  was  demonstrated  by  implementing  a  fast- 
acceleration  set  of  rate  limits  in  the  transition  control.  The  resulting  sea  level/static  acceleration  from 
idle  to  intermediate  thrust  in  Figure  12  shows  a  reduction  in  the  response  time  from  3.2  to  2.2  seconds. 

The  .esults  of  the  sensor  failure  study  at  the  30  Kft/0.9  condition  indicated  that  most  sensor  failures 
would  result  in  a  safe,  downtrimming  to  a  part-power  condition..  The  saturation  of  the  PT2  sensor  or  the  loss 
of  the  fan  speed  sensor,  however,  resulted  in  an  overspeed  and  overtemperature  condition. 
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Engine  tests  were  run  at  five  subsonic  and  four  supersonic  test  points. (20)  The  flight  conditions  and  'i 
the  types  of  tests  conducted  are  shown  in  Table  1.  In  certain  regions,  air  flow  and  burner  pressure  con-  I 
straints  limit  the  range  of  steady-state  operation  to  near  intermediate  (PLA  =  83%)  operation.  Transient  j 
control  performa-ce  was  evaluated  by  subjecting  the  control  to  small  (3°)  PLA  steps,  to  large  PLA  snaps  and  j 
chops,  to  random,  cyclic  PLA  motion  and  to  zone  one  afterburner  lights.  In  addition,  simulated  flight  i 
maneuvers  were  performed  during  the  engine  tests.  1 


ALTITUDE  (FT) 
MACH  NUMBER 

STEADY 

STATE 

POWER  LEVER  ANGLE 

PLA  TRANSIENTS 

DISTURBANCES 

PLA  = 

83° 

PLA 

<  83' 

AFTER¬ 

BURNER 

MANEUVER 

OR 

FAST  ACCEL 

LARGE 

SMALL 

CYCLIC 

0/0 

• 

• 

• 

0 

0 

0 

0 

10/0.6 

• 

A 

• 

A 

•  A 

0  A 

0  A 

0 

A 

0  A 

10/0.9 
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A 
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A 
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A 
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A 
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A 
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A 
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0 

0 
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0 
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• 

0 

0 

0 
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A 

• 

A 

0  A 

0  A 

0 

0 

20/1.8 

• 

0 

0 

55/1.8 

A 

A 

35/1.9 

A 

A 

75/1.9 

• 

0 

0 

40/2.2 

• 

• 

55/2.2 

A 

A 

60/2.15 

• 

0 

0 

65/2.5 

0 

0 

SENSOR 

FAILURES 
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•  HYBRID  TEST 
A  ENGINE  TEST 


TABLE  I 

SUMMARY  OF  FiOO  MVCS  HYBRID  EVALUATION 
AND  ALTITUDE  TEST  CONDITIONS 


Prior  to  the  MVCS  tests,  over  225  steady-state  and  91  transient  tests  were  recorded  using  the  standard 
F100  control  logic.  These  baseline  tests  were  performed  to  record  the  XD11-8  engine's  reference  point 
values.  Also,  total  and  static  pressure  data  at  station  2.5  were  recorded  and  used  to  synthesize  the  fan 
discharge  Ap/p  parameters. 

From  these  tests,  it  was  found  that  engine  X011-8  differed  significantly  in  operating  characteristics  from 
the  nominal  engine  described  by  the  digital  simulation.  Since  the  reference  point  schedules  used  in  the  MVCS 
control  were  based  on  simulation  data,  some  adjustments  were  made  to  the  reference  point  schedules  prior  to 
engine  test.  Also  during  the  baseline  tests,  the  MVCS  limit  mode  switching  logic  and  failure  detection  logic 
we  e  thoroughly  checked  out. 

Steady-state  operating  data  were  taken  at  309  combinations  of  flight  condition  and  power  lever  angle. 

The  MVCS  tracked  the  reference  point  schedules  well.  FTIT  and  four  burner  pressure  limits  were  accomodated 
where  required  for  safe  operation.  The  integral  trims  held  the  RCVV's  and  CIVV's  to  their  respective  schedules. 
The  fan  rotor  speed  and  fan  discharge  Ap/p  were  held  to  their  schedules  values  through  the  use  of  integral 
trims  on  exhaust  nozzle  area  and  main  burner  fuel  flow. 

In  general,  steady-state  performance  of  the  F100  MVCS  control  was  good  at  all  points  tested.  The 
integral  control  action  held  scheduled  variables  close  to  their  scheduled  values.  Minor  reference  point 
schedule  adjustments  allowed  schedule  matching  without  controls  saturating  or  engine  variables  exceeding 
allowable  limits. 

Transient  performance  wasjissessed  at  all  the  flight  points.  Large  PLA  transients  were  run  at  all 
points  where  air  flow  constraints  permitted  PLA  operation  below  83°.  Small  FLA  transients  of  3°  were 
run  to  check  the  regulator  performance  while  random  PLA  sequences  were  run  to  verify  correct  gain  scheduling 
operation.  In  all  cases,  PLA  was  cnanged  at  a  rate  of  +  126°/sec.  A  programmable  function  generator  was 
used  to  control  the  PLA  during  the  transient  tests  to  insure  repeatability. 

A  total  of  93  transients  were  run  on  multivariable  control.  A  few  which  highlight  key  operational 
features  of  the  control  logic  are  presented  here. 
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Figure  13  shows  the  response  of  the  engine  to  a  large  PLA  snap  from  23°  to  83°  at  flight  point  C  (10000 
ft;  Mach  0.9).  Several  functions  of  the  MVCS  control  are  exercised  with  this  transient:  transfer  from  fan 
speed  trim  to  FTIT  trim,  regulator  and  integrator  gain  scheduling  as  a  function  of  compressor  speed,  FTIT 
estimation  and  the  trimming  of  nozzle  rea  to  set  fan  exit  tp/p.  As  can  be  seen  in  the  figure,  an  idle 
to  intermediate  power  lever  step  was  initiated  at  around  0.5  seconds.  The  transition  control  generated 
requested  value  of  states  and  controls.  The  regulator  causes  the  sensed  variables  to  track  their  scheduled 
values.  The  response  is  safe  and  stable  with  little  or  no  overshoot.  The  FTIT  estimator  senses  an  FTIT 
limit  exceedence  at  around  1  second.  At  this  point,  the  fuel  flow  integrator  input  error  was  switched 
from  fan  speed  to  FTIT.  The  result  is  that  fuel  flow  begins  to  cut  back  from  the  scheduled  transition  fuel 
flow.  Notice  that  sensed  fan  speed,  while  being  on  schedule  at  the  start  of  the  transient,  has  fallen  below 
its  scheduled  value  and  that  FTIT  is  approaching  its  limit. 

Initially,  the  nozzle  area  opened  in  response  to  the  negative  fan  speed  error.  At  time  equals  three 
seconds,  the  nozzle  area  begins  closing  to  null  out  the  negative  tail  pipe  pressure  Pg.  The  nozzle  area 
integrator  trim  reduces  nozzle  area  farther  until  Ap/p  is  on  schedule.- 

Afterburner  lights  were  performed  at  all  test  points  to  investigate  the  ability  of  th?  MVCS  control 
logic  to  attenuate  external  disturbance.  Figure  14  shows  the  result  of  an  afterburner  light  at  30,000  feet 
and  Mach  0.9.  As  is  shown  in  the  top  of  Figure  14,  a  fuel  pulse  is  initiated  at  time  equals  0.5  second. 

Tail  pipe  pressure,  Pg,  rises  sharply  and  the  fan  and  core  speeds  fall  off.  Fan  speed  error  causes  the 

exhaust  nozzle  area  to  open  bringing  the  sensed  fan  speed  back  toward  the  scheduled  value.  The  exhaust 
nozzle  area  trim  integrator  further  opens  the  nozzle  until  fan  discharge  Ap/p  is  back  on  schedule.  The  MVCS 
control  logic  successfully  suppressed  afterburner  pressure  disturbances  at  all  other  flight  points  except 
for  45,000  and  50,000  feet,  Mach  0.9.  At  these  two  points,  sensed  fan  discharge  Ap/p  did  not  change 

sufficiently  to  allow  nozzle  trim  control  to  suppress  the  disturbance.  As  shown  in  Figure  14,  the' MVCS  con¬ 

trol  logic  far  exceed  expected  results  in  meeting  the  design  goals  for  afterburner  suppression. 

A  total  of  nine  simulated  flight  maneuvers  were  performed  to  test  the  control  logic  performance  with 
varying  PLA  and  flight  conditions.  These  maneuvers  included  combinations  of  climbs,  dives,  accels  and  decels. 
The  MVCS  control  logic  performed  well  in  all  tests.  Figure  15  shows  one  such  maneuver.  Here,  an  accel  was 
performed  at  constant  altitude  (10,000  ft).  Actual  pressure  altitude  Mach  number  increased  from  0.6  to  0.9 
in  about  15  seconds.  Inlet  temperatures  could  not  be  changed.  The  initial  condition  was  standard  day  and 
the  final  condition  is  about  40°F  colder  than  standard  day.  As  shown  in  the  figure,  PLA  is  increased  from 
65°  to  83°  in  about  5  seconds.  The  compressor  speed  transition  was  smooth  with  a  slight  overshoot.  Fan  speed 
tracked  its  scheduled  value  with  also  a  slight  overshoot.  At  about  4  seconds,  the  FTIT  estimator  reaches  a 
limit  and  the  fuel  flow  trim  integrator  uses  trimming  on  fan  speed  error  and  begins  downtrimming  fuel  flow  to 
keep  FTIT  below  its  limit.  The  exhaust  nozzle  area  close  down  to  keep  fan  discharge  Ap/p  or,  schedule. 

During  the  altitude  tests,  alternate  control  trim  modes  were  also  run,  demonstrating  the  flexibility  of 
the  control  logic  structure.  One  such  mode  was  the  EPR-N,  trim  mode  where  engine  pressure  ratio  replaces  fan 
discharge  Ap/p  as  the  other  variable  used  along  with  fan  speed  specify  the  fa.  operating  line.  The  modular 
structure  made  it  possible  to  easily  change  control  modes.  The  EPR-N,  mode  required  only  new  regulator  and 
integrator  gains  to  be  entered.  Under  limited  testing  the  EPR-N,  control  mode  performed  quite  well.  Another 
control  change  was  the  "fast  accel"  mode  which  was  verified  in  the  hybrid  testing.  Here  the  transition 
control  rates  were  increased  to  obtain  a  more  rapid  than  normal  engine  response.  The  modular  structure  of  ihe 
control  permitted  this  change  to  be  made  without  changing  regulator  or  integral  gains,  or  the  reference  point 
schedules. 

Also,  the  sensor  and  actuator  failure  detection  and  accoimtodation  logic  was  tested  at  several  flight 
points.  In  all  cases,  the  engine  transfer  to  a  safe  power  condition  was  safe,  smooth  and  orderly. 


Conclusions 


The  objective  of  the  F100  Multivariable  Control  Synthesis  Program  was  to  demonstrate  that  a  control 
could  be  designed  using  linear  quadratic  regulator  (LQR)  design  methods  that  would  operate  a  modern  turbofan 
engine  over  its  entire  flight  envelope.  The  LQR  design  methods  were  used  to  develop  feedback  gains  for  a 
series  of  operating  points.  Reference  schedules  were  used  to  translate  pilot  and  ambient  inputs  to  reference 
point  specifications.  A  transition  controller  was  used  to  produce  smooth  and  rapid  transitions  from  one 
operating  point  to  another.  A  variable  structure  integral  trim  conti ol  was  designed  to  produce  specified 
steady-state  performance  and  to  accommodate  limits.  The  performance  of  the  multivariable  contro1  was  evaluated 
or.  a  real-time  simulation  of  the  P&W  F100  turbofan  engine  with  the  control  logic  programmed  on  a  digital 
computer.  Use  of  the  real-time  simulation  allowed  program  debugging  and  verification  of  proper  control  logic 
functioning  prior  to  engine  tests  m  an  altitude  facility.  Sensor  and  actuator  fail "re  detection  logic  was 
developed  and  checked  out  by  simulating  transfers  from  multivariable  to  a  backup  coi  *rol. 

The  multivariable  control  was  tested  while  controlling  an  F100  engine  at  ten  flight  points  in  an  altitude 
facility.  The  control  exhibited  good  steady-state  performance,  i.e.,  the  ability  to  hold  engine  trim  variables 
on  schedule  at  all  flight  points.  Tests  of  the  engine  with  BOM  control  prior  to  multivariable  control  tests 
provided  data  which  were  used  to  adjust  some  of  the  reference  point  schedules.  This  allowed  tracking  of 
reference  point  schedules  without  trim  saturation  und  matching  of  engine  operating  lines  obtained  with  BOM 
control . 

Good  transient  performance  was  demonstrated  at  almost  all  flight  points.  The  integral  trims  successfully 
accommodated  FTIT  limits  and  low  burner  pressure  limits  where  required.  The  control  attenuated  afterburner 
pressure  pulses  occurring  during  afterburner  lights  at  all  but  two  flight  points.  At  supersonic  points,  where 
operation  was  permitted  only  at  intermediate  and  above,  excellent  suppression  of  afterburner  disturbances 
was  observed.  The  multivariable  control  successfully  operated  the  engine  for  random  PLA  excursions,  thereby 
verifying  the  correct  functioning  of  regulator  gain  schedules  and  transition  logic.  A  number  of  flight 
maneuvers  were  performed  to  check  the  control’s  performance  with  simultaneously  varying  PLA  and  ambient 
conditions.  Thj  control  cracked  reference  point  schedules  well  and  accommodated  all  limits. 


Programming  flexibility  which  exists  due  to  the  modular  structure  of  the  multivariable  control  was 
demonstrated  by  testing  two  alternate  control  modes.  A  fast  acceleration  set  of  transition  control  rates 
was  implemented  which  allowed  more  rapid  engine  accelerations.  Also,  the  integral  trim  structure  was 
changed  to  use  engine  pressure  ratio  instead  of  the  fan  discharge  Mach  number  parameter  normally  used  with 
the  multivariable  control.  The  new  trim  structure  worked  satisfactorily,  requiring  only  a  change  of  gain 
matrices  to  implement  it. 

Sensor  and  actuator  failure  detection  logic  was  incorporated  into  the  control  for  altitude  tests  and 
functioned  well  in  conjunction  with  a  backup  control.  All  logic  was  programmed  in  9.5K  of  core,  using  a 
12  m.sec.  computer  cycle  time.  These  computer  requirements  are  within  the  capabilities  of  present  generation 
computers  envisioned  for  use  as  engine  mounted  digital  controls. 

It  is  concluded  that  LQR-based  control  design  techniques  can  be  successfully  used  to  design  digital  engine 
controls.  Its  systematic,  structured  approach  has  much  to  offer  in  the  design  of  controls  for  new  generation 
airbreathing  engines. 
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FIGURE  13  POWER  LEVEL  TRANSIENT  23*  -  83' 
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DISCUSSION 


M.P.Perks,  UK 

Temperaturi  Measurement.  The  problems  you  experienced  with  temperature  measurement  are  typical  of  transducer 
problems  now  seen.  How  necessary  is  it  to  go  to  the  type  cf  prediction  technique  you  used,  bearing  in  mind,  that 
engine  turbines  themselves  will  respond  even  slower  to  temperatures  of  the  gas  path  than  the  thermocouples 

Author’s  Reply 

Maximum  compressor  exit  temperature  and  maximum  burner  temperatures  are  indirectly  specified  by  FTIT  limits 
by  the  engine  manufacturers.  Because  of  this  and  the  fact  that  we  would  usp  currently  available  sensors,  we  chose  to 
compensate  the  FTIT  sensor.  Perhaps  the  term  estimator  is  inappropriate.  The  purpose  of  the  FTIT  compensation 
is  to  predict  or  lead  the  actual  temperature  in  order  that  larger  throttle  transients  will  not  lead  to  excessive  tempera¬ 
ture  overshoots.  The  estimator  output  is  used  to  trigger  a  switch  in  control  modes  in  order  to  make  safe  transients 
and  not  as  an  estimator  of  air  or  blade  temperature. 


E. Roberts,  UK 

( 1 )  What  sample  periods  were  used  in  the  tests0 

(2)  Could  reheat  lightups  have  been  missed  because  of  sampling? 

Author’s  Reply 

( 1 )  Our  objectives  in  this  effort  concentrated  on  the  ability  of  the  modern  control  theory  techniques  to  become  a 
viable  method  upon  which  to  base  a  control  design.  As  a  result  we  specified  a  sample  time  of  10  milliseconds 
in  order  that  stability  problems  due  to  sampling  too  slowly  would  not  be  a  problem.  During  the  engine  testing, 
we  used  a  1 2  millisecond  up-date  time. 

(2)  Because  of  our  high  sample  rate  and  the  fact  that  the  afterburner  pulses  were  of  long  duration,,  it  is  not  likely 
that  we  may  have  missed  them.  The  afterburner  light  offs  were  simply  not  severe  enough  to  be  sensed  by  our 
fan  exit  mach  number  probe.  The  FI 00  has  a  five  zone  augmentor  and  in  our  tests  we  lit  only  the  first  zone,  so 
they  weie  not  full  augmentor  lights. 


N.Munro,  UK 

(1 )  Have  you  been  able  to  consider  any  of  the  modern  multi-variable  frequency-domain  design  methods  developed 
in  the  UK  and  exposed  at  the  NEC  Chicago  conference? 

(2)  Since  you  are  obliged  to  use  integral  action  in  addition  to  the  LQR  controller,  would  you  agree  that  a  simpler 
design  might  have  been  achieved  by  a  direct  use  of  the  frequency-response  methods? 

Author’s  Reply 

(1 )  The  program  described  in  this  paper  began  in  1976.  Subsequently,,  the  interest  m  multivariable  control  design 
techniques  was  spawned  by  this  program  and  indeed,  the  theme  problem  for  the  NEC  conference  was  the  FI 00 
engine  represented  by  a  linear  model  of  the  engine.  Becaus :  of  the  success  of  our  research  using  linear  time 
domain  techniques,  we  have  continued  to  concentrate  our  e  fforts  in  this  arpa. 

(2)  Actually,  the  LQR  gains  and  integral  trim  gains  represent  Ci'.iv  a  small  portion  of  the  controller  We  chose  to 
use  integral  trim  control  in  order  to  achieve  the  precise  steady  state  regulation  specified  b\  the  engine  manu- 
idcturer.  The  requirement  to  respect  diffenng  operating  constraints  throughout  the  flight  envelope  must  be 
satisfied.  The  use  of  integral  trim  control  allows  for  smooth  tvnsitions  from  one  control  mode  to  another 
Another  advantage  is  that  the  inf"gral  action  on  one  control  variable  has  a  minimal  effect  on  the  othei  variables 

Frmn  my  understanding  of  frequency  domain  methods,  a  set  of  control  design  gains  for  each  operating 
condition  where  differing  control  requirements  are  to  be  satisfied  must  be  done.  1  have  not  seen  a  frequency 
domain  design  that  will  accomplish  a  transition  from  a  normal  control  mode  to  another  mou  m  order  to  keep 
a  variable  !  ebw  a  specified  limit,  and  do  it  with  minimal  switching  interaction 

Therefore,  I  cannot  agree  that  a  frequency  domain  design  would  have  bjen  simpler.  It  is  difficult  to  compare 
techniques  when  they  have  not  been  used  to  solve  the  same  problem 
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ENGINE  INTAKE  CONTROL  DESIGN  FOR  ADVANCED 
FIGHTER  AIRCRAFT 

by 

Dino  Dini 
R.  Lazzeretti 
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SUMMARY 

This  paper  reviews  the  factors  influencing  variable  geometry  intake  design  for  fighter  aircraft  over 
their  flight  velocity  profile. 

Separate  operating  performance  ranges,  depending  on  the  positions  of  the  changeover  valves,  ramps 
and  doors,  are  analyzed  for  an  acceptable  design  compromise.  A  criterion  for  prediction  of  airframe  inte¬ 
gration  effects  on  inlet  stability  with  application  to  advanced  fighter  aircraft  is  presented  and  discuss¬ 
ed. 

To  accomodate  desired  flow  changes  through  the  engine  as  flight  speed,  altitude  and  climatic  condi¬ 
tions,  change,  the  control  of  intake  is  studied  and  designed,  taking  intp  account  mutual  interferences 
between  propulsion  units  and  controlled  elements. 

Airframe/propulsion  integration  in  fighter  aircraft  is  considered  in  the  design  of  intake  control. 

FIGHTER  CLASSIFICATION  AND  OPERATIONAL  PERFORMANCES 

Tactics  of  future  fighter  aircraft  has  to  be  improved,  and  in  particular  pilots  have  to  be  assisted 
in  the  execution  of  complex  tactical  maneuvers,  in  order  to  obtain  superior  combat  capability.  In  the 
field  of  avionic  development,  the  future  technology,  for  the  application  of  the  ever  widening  range  of 
sensors  together  with  the  associated  data  processing  and  control  systems,  seems  almost  limitless. 

Fighter  performance  includes  the  capability  to  generate  forces  which  allow  a  transition  from  one 
flight  condition  to  another.  Combat  maneuvers  nearly  always  take  place  at  high  speeds  in  a  relatively 
small  airspace  and  therefore  it  is  interesting  to  consider  the  performance  level  required  in  relation  to 
the  air  space  available.  Required  load  factors,  bank  angles  and  power  settings,  are  dependent  on  the  type 
of  fighter  aircraft  mission:  interception,  air  combat,  ground  attack. 

Turning  performance  is  not  predominant  in  the  interceptor  fighter,  requiring  high  speed  and  high  longitu¬ 
dinal  acceleration  toward  a  non-manoeuvring  target,  and  there  is  little  need  to  consider  low  speed  combat. 
The  aerodynamic  configuration  is  characterized  by  low  profile  and  wave  drags. 

Airfield  performance  is  important  in  the  air  combat  fighter,  at  low  or  medium  altitude,  and  the  highest 
supersonic  speeds  are  not  necessarily  required.  The  bps  possible  sustained  and  istantaneous  turning  per¬ 
formance  is  essential.  From  the  aerodynamic  point  of  view,  low  induced  drag  at  high  "g"  and  good  depar¬ 
ture  characteristics  as  the  dynamic  stall  is  approached,  are  required. 

High  wing  loading  is  desirable,  for  improving  the  ride  quality  and  aiming  accuracy  in  respect  to  the  tar¬ 
get  in  conditions  of  rough  air,  in  the  medium-range  air-to  surface  attack  airplane  (ground  fighter).  The 
wing  loading  is  much  higher  than  for  the  other  fighter  types.  There  is  no  need  for  supersonic  performance 
and  high  turning  performance.  An  acceptable  compromise  between  the  overall  aerodynamic  efficiency,  on  the 
way  to  the  target,  and  the  high  drag  rise  Mach  number  and  the  store  carriage  arrangement,  is  characteriz¬ 
ing  the  aerodynamic  design. 

For  compromising  the  ideal  characteristics  of  two  of  the  three  fighter  types,  the  engine  development 
is  no  more  centered  around  fixed  cycle,  afterburning  tu-bofan  engines,  but  around  variable  geometry  and 
multicyr  e  engines.  The  design  condition  is  predominantly  at  high  subsonic  speeds,  for  tight  combat  turns 
and  high  rates  of  climb.  Here  the  engine  is  used  in  full  afterburning  mooe,  with  the  transonic  cruise  legs 
performed  at  maximum  dry  power.  Engine  requirements  for  the  interceptor  fighter  in  supersonic  flight  re¬ 
sult  ii  higher  compressor  pressure  ratios,  some  what  higher  fan  by-pass  ratios,  and  more  sophisticated 
variable  geometry  air  intakes  and  ejector  nozzles. 

Even  though  with  some  difficulties  for  the  compromise,  the  MRCA  Tornado  might  be  regarded  as  lying  along, 
the  side  joining  air-to-surface  attack  and  interceptor,  while  the  F— 1 5  would  lie  more  nearly  on  the  line 
joning  interceptor  and  air  combat  fighters. 

Those  aircraft  substantially  designed  air-to-surface  attack  have  higher  wing  loadings  than  those  designed 
for  air  combat,  with  the  interceptor  generally  intermediate:  F-14B  (2.50  -  7.28  aspect  ratio;  489  kJ/m2, 
take  off  weight,-  and  4.3  kJ/m2,  combat  weight,  wing  loading);  as  compared  to  F-15  (3.0  aspect  ratio; 

3.02  kJ/m2,  take  off  weight,  and  2.78  kj/m2,  combat  weight,  wing  loading).  A  practical  limit  for  fixed 
wing  aircraft  is  a  combination  of  2.87  kJ/nh  wing  loading  at  combat  weight,  anf  aspect  ratio  of  abound 
3.5. 

The  F-14B  shows  the  powerful  effect  of  variable  sweep,  to  compensate  for  the  high  wing  loading;  in  fact,- 
the  span  loading  parameter  is  1.96  kj/m2  at  take  off  weight,-  1.72  kJ/m2  at  combat  weight  wing  swept,  and 
0.6  kJ/m2  at  combat  weight  with  wing  spread. 

The  delta  design  combines  its  moderate  wing  loading  with  the  highest  of  the  span  loading. 

kith  the  aid  of  the  computer  and  the  simulation  of  air  combat,  a  search  is  started  to  determine  the 
parameters  which  best  characterize  the  future  fighter  aircraft  A  measure  of  maneouvrabil i ty  was  given  by 
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the  area  of  the  diagram  between  the  specific  excess  power  (S.E.P.  =  (T-D)*V/W)  against  sustained  turn-rate 
at  given  Mach  number  and  altitude.  S.E.P.  is  regarded  as  one  measure  of  combat  capability  and  is  equiva¬ 
lent  to  steady  rate  climb.  The  boundaries  of  sustained  capability  of  an  aircraft  embracing  maximum  speed, 
ceiling  either  at  1  g  or  when  manoeuvering,  are  all  obtained  when  S.E.P.  is  equal  to  zero.  But,  since 
S.E.P.  is  proportional  to  longitudinal  acceleration  and  turn  rate  is  about  proportional  to  normal  acceler¬ 
ation,  a  more  useful  diagram  results  by  plotting  the  two  accelerations  against  each  other.  In  such  a  way, 
we  have  diagrams  corresponding  to  the  envelope  of  the  resultant  acceleration  vector  of  the  aircraft;  e.g. 
at  a  given  sea  level  Mach  number,  from  airbrake  to  maximum  thrust,  considering  the  effect  of  extra  lift 
and  thrust  or  the  effect  of  variable  sweep  wing  and  vectored  thrust.  With  structural  design  limits  of  +  8 
and  -  4  g,  as  values  of  the  normal  acceleration,  the  pilot,  flying  in  stabilized  flight,  may  ask  maximum 
longitudinal  acceleration  by  opening  the  throttle  and  selecting  reheat,  going  in  a  few  seconds  to  the  max¬ 
imum  normal  acceleration  rolling  the  aircraft  through  substantially  90°.  In  the  next  generation,  we  need 
less  than  2  to  5  seconds  engine  acceleration  times,  fast  operating  airbrakes,  and  very  high  rates  of  roll 
and  pitch. 

Although  the  pilot  controls  load  factor  and  bank  angle,  the  standard  cockpit  instrumentation  is  not 
adequate  to  permit  him  to  fly  consciously  a  pre-determined  control  schedule.  A  limited  number  of  key  points 
defines  the  shape  of  the  maneuver  in  the  initial  phase,  since  the  target  most  probably  has  not  yet  been 
acquired.  The  pilot  has  some  time  available  to  look  the  instrumental  information,  but  it  is  impossible  to 
make  in  practice  usable  estimates  of  these  data,  leading  to  the  desired  weapon  delivery  conditions.  I r  a 
number  of  cases  t. a  actual  execution  of  combat  maneuvers  does  not  lead  to  the  desired  flight  conditions, 
so  that  its  effectiveness  is  degraded.  The  parameters  that  affect  the  flight  are  related  to  the  perform¬ 
ance  characteristics  of  the  fighter.  The  relative  flight  control  system  is  normally  associated  with  un¬ 
desirable  complexity,  for  the  very  high  number  of  parameters  which  affect  the  flight  path.  This  complexi¬ 
ty  may  be  minimized  by  a  parametric  simulation  during  the  pre-hardware  design  phase  for  longitudinal,  lat¬ 
eral  and  directional  control,  to  realize  an  adequate  automatic  flight  control  system. 

For  a  ground  fighter,  as  an  example,  a  possible  primary  and  alternate  mission  profile  is  shown  in 
figure  1,  Ref.  1.  Such  a  vehicle  would  be  expected  to  operate  a  large  percentage  of  its  life  at  dry  su¬ 
personic  near  12-15  OOOmaltitude  and  at  speeds  in  the  neighborhood  of  Mach  1.6- 2.0,  depending  on  en¬ 
gine  availability  for  dry  supersonic  operation.  At  maximum  dry  thrust,  the  fuel  consumption  may  already 
be  twice  that  at  the  clean  cruise  and,  for  the  later  designs,  the  fuel  flow  at  maximum  reheat  may  be  mul¬ 
tiplied  by  a  further  factor  of  5  or  6. 

The  dry  and  reheated  thrusts  at  M  «  0.8  sea  level,  expressed  as  thrust/weight  ratio,  for  aircr. ft  with 
full  internal  fuel  and  missiles,  are,  respectively:  F-14B  (0.6,  1.35),  F— 15  (0.58,  1.33),  F-18L  (0.62, 
1.4),  F-16  (0.5,  1.5),  F-4K(0  45,  0.95),  MIG  21K  (0.52,  0.85). 

Th's  means  that  the  combat  time  in  full  reheat  is  measured  in  minutes,  considering  a  fuel  supply  for  an 
hour  of  clear,  cruise  at  low  altitude. 

More  development  has  to  be  placed  in  the  area  of  aerodynamics,  stability  and  control,  and  propulsion, 
to  achieve  the  desired  fighter  performance  objectives. 

Variable-camber  wing,  automatically  programmed  as  a  function  of  Mach  number  ar.d  angle  of  attack,  may  in¬ 
crease  the  sustained-maneuver  L/D.  A  weight  reduction,  in  favour  of  volumetric  efficiency,  overall  size 
and  cost,  is  obtained  by  wing-body  blending  adoption.  The  use  of  blending  permits  greater  flexibility  in 
tailoring  the  area  distribution  curve,  providing  a  better  wetted  -  area  -  to  volume  ratio.  The  controlled 
vortex  principle  in  highly  swept  delta  wing  configurations  permits  to  achieve  the  proper  balance  between 
aerodynamic  performance,  stability  and  control.  The  use  of  the  fly -by -wire  control  system  provides  the 
flying  qualities  to  utilize  the  advances  in  aircraft  aerodynamics  and  propulsion  systems.  The  aircraft's 
flight  control  has  no  mechanical  connection  between  the  pilot  control  and  the  control  sui faces.  The  re¬ 
laxed  static  stability  aspect  of  control  configured  vehicle  technology  is  adopted  to  increase  the  maneu¬ 
vering  performance.  The  instability  at  subsonic  speeds,  including  gust  effects  is  well  governed  by  con¬ 
trol  power. 

The  inlet  location  is  selected  to  meet  the  high  -  maneuver  -  performance  requirements,  to  provide  a 
good  area  distribution,  and  to  produce  low  distortion  and  turbulence  at  the  compressor  face.  The  normal- 
shock  design,  simple  and  low  cost  configuration,  represents  a  compromise  to  the  maximum  speed  performance 
in  combat  regime.  The  fixed  -  geometry  design  is  lighter  than  a  complete  variable  -  geometry  inlet  planned 
for  optimum  performance  over  the  structural  design  Mach/altitude  envelope  of  the  airframe. 

As  the  functional  requirements  of  the  flight  control  system  increase,  < nd  as  the  mission  reliability 
and  safety  requirements  dictate  the  need  for  redundant  systems,  digital  mechanization  of  the  flight  con¬ 
trol  electronics  is  preferred.  The  advantage  of  digital  flight  control  systems,  when  compared  with  analog 
systems,  have  been  attributed  largely  to  the  stored  program  increased  computational  accuiacy  and  flexi¬ 
bility.  However,  the  software  associated  with  this  flexibility  represents  a  new  element  in  the  flight 
control  system  design  process,  requiring  specification  and  development.  Advantages  of  the  digital  mecha¬ 
nization  are,  essentially,  superior  capability  of  the  digital  computer  to  execute  logic  functions,  and 
improvement  of  flying  qualities  by  using  control  laws  not  feasible  with  analog  systems. 

The  now  available  new  techniques  for  the  design  of  the  control  and  stabilization  systems  lead  to  a 
remarkable  improvement  of  the  expected  mission  effectiveness  and  to  the  innovation  of  new  modes  of  opera¬ 


tion. 
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DEVELOPMENTS  IN  CONTROL  SYSTEMS  FOR  VARIABLE  GEOMETRY  FIGHTER  POWERPLANTS 

Engines  of  much  higher  specific  thrust  than  the  conventional  turbo-fans  have  to  be  used  for  the  wide 
flight  envelope  of  high  performance  fighters.:  There  is  a  growing  tendency  to  prefer  twin  engine  installa¬ 
tions.  In  these  cases,  the  empty  airplane  weigh:  penalty  may  be  less  than  97..  This  is  due  in  large  part 
because  the  airframe  structure  grows  and  there  are  additional  problems  to  optimize  the  afterbody  design 
for  low  transonic  drag,  both  with  and  without  afterburner. 

Although  the  by-pass  principle  is  commonly  used,  by-pass  ratios  are  generally  around  unity  or  lower.  The 
by-pass  and  core  engine  flows  are  generally  remixed  in  the  jet  pipe  to  feed  a  single  propelling  nozzle. 

Jet  pipe  reheat  is  normally  used  to  provide  the  large  thrust  boost  needed  for  supersonic  flight;  but  there 
is  considerable  interest,  at  some  flight  conditions,  on  attaining  the  greatest  possible  thrust  with  reheat 
unlit  (e.g.,  the  very  low  altitude  penetration  to  the  target  on  a  strike  mission,  requiring  flight  at  a 
high  speed  with  good  fuel  economy). 

The  maximum  dry  thrust  available  tends  to  be  the  factor  which  limits  flight  speed.  This  is  tne  rea¬ 
son  because  design  is  concetrated  on  the  technique  of  supercharging  the  core  engine.  The  problem  is  to 
define  efficient  dry-power  engines  for  supersonic  cruise,  that  would  satisfy  transonic  acceleration  and 
subsonic  requirements.  Variable  geometries  and  cycles  provide  increase  in  air  flow  as  well  as  pressure 
ratio,  to  produce  efficient  matching  for  a  variety  of  operating  conditions,  especially  if  efficient  sustain¬ 
ed  supersonic  cruise  is  desired. 

By-pass  engines  may  by  adapted  to  multi-mission  fighter  capability. 

For  the  ground  fighter,  variable  cycle  engines,  which  provide  air-flow  variation  through  variable  turbine 
area  and  variable  nozzles  and  compressor  stator  blades,  in  combination  with  high  throttle  ratio,  may  have 
different  solutions,  all  based  on  the  by-pass  principle:  mixed  burning  stream  (with  variable  geometry  fans 
and  compressors,  and  conventional  control);  high  throttle  ratio  (with  increased  air-flow  control,  and  var¬ 
iable  area  turbines);  duct  burning  (with  increased  air-flow  control,  adjustable  nozzles,  and  variable  com¬ 
pressors);  variable  pressure  ratio  (with  pressure  ratio  control,  by-pass  ratio  control,  and  adjustable 
nozzles);  rear  valved  (with  pressure  ratio  control,  by-pass  ratio  control,  and  adjustable  nozzles).  By¬ 
pass  ratio  may  range  from  0.2  to  1.3,  and  pressure  ratio  from  15  to  20  or  more. 

Figure  2  shows  a  two-shaft  low  by-pass  ratio  powerplant.  Variable  cycle  features  for  thrust  boosting  are 
indicated.-  The  increase  of  low  pressure  ratio  for  higher  thrust  is  applied  to  the  fan  as  a  whole,  thus 
raising  by-pass  pressure  as  well  as  core  entry  pressure..  The  application  of  the  core  supercharging  prin¬ 
ciple  for  increasing  the  thrust,  does  not  increase  the  turbine  entry  temperature,  even  though  a  relative¬ 
ly  small  raise  in  high  pressure  rotor  speed  is  obtained. 

The  interest  in  engines  with  a  variable  thermodynamic  cycle  is  extended  to  fighter  aircraft,  because 
of:  favourable  specific  fuel  consumption,  in  supersonic  and  subsonic  flight,  with  or  without  reheat,  and 
thrust  characteristics;  optimum  engine  integration  and  handling  qualities;  high  maximum  dry  thrust,  relat¬ 
ed  to  maximum  reheated  thrust;  high  aerodynamic  stability  on  afterburner  light  up;  optimum  matching  of 
intake  capacity  and  engine  mass  flow;  good  compatibility  with  intake  distortions;  favourable  afterbody/ 
nozzle  aerodynamics;  low  effect  of  bleed/power  off-take  on  engine  performance  and  stability;  acceptable 
weight  and  cost. 

Considering  the  by-pass  principle,  in  which  downstream  of  the  fan  the  total  airflow  is  divided  be¬ 
tween  an  outer  fan  duct  and  the  central  core  engine,  the  variable  cycle  concept  may  be  realized  as  fol¬ 
lows,  Ref.  2: 

-  the  turbines  and  the  internal  flaps  in  the  exhaust  system  can  be  given  settings  to  provide  a  turbofan 

operating  with  two  or  three  streams.  For  supersonic  cruise  flight,  with  two  streams,  the  second  one  is 

not  burning  in  the  duct.  This  stream  is  burning  for  take-off,  climbing  and  transonic  acceleration.  Ope¬ 

ration  on  three  streams  without  duct  burning  is  used  for  subsonic  cruise  flight; 

-  when  low  thrust  is  required,  in  subsonic  cruise  flight,  ..he  high  pressure  -  system  runs  with  high  output, 
the  entire  engine  working  as  a  turbofan  with  duct  burning  shut-off.  When  high  thrust  is  required,  the 
high  pressure  system  is  throttled,  while  duct  burning  is  on  at  high  temperature,  woiking  as  a  turbojet. 
Modulation,  throttling,  and  appropriate  harmonization  of  the  burning  temperature,  consent  intermediate 
operations; 

-  the  by-pass  ratio  may  be  modified  by  the  variable  high  and  low  pressure  turbines  and  internal  flaps, 

having  high  thrust  (with  or  without  duct  burning)  at  low  by-pass  setting,  and  higher  by-pass  ratio  for 

subsonic  cruise; 

-  the  variable  turbofan  provides,  through  variable  1 plitter,  intermediate  and  low  pressure  turbines,  pri¬ 
mary  and  secondary  nozzles,  a  considerable  range  of  by-pass  ratios  by  keeping  the  two  streams  separated. 
The  engine  works  in  reheat  operation  with  a  by-pass  ratio  equal  to  zero.  The  afterburner  cooling  air 
taken  off  down-stream  of  the  intermediate  compressor  is  throttled  as  in  the  case  of  the  variable  turbo¬ 
jet; 

-  the  variable  turbojet,  with  variable  turbines  and  final  nozzle,  provides  optimum  pre-requisites  in  connec¬ 
tion  with  the  afterburner,  to  be  cooled  by  compressed  air  which  is  throttled,  preventing  reaction  on  the 
compressor. 

The  effectiveness  of  a  multi-role  combat  fighter  requires  an  engine  concept  that  combines  the  advan¬ 
tages  of  the  reheated  turbojet;  i.e.  favourable  ratio  of  dry  thrust  to  thrust  with  reheat,  good  specific 
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fuel  consumption  with  reheat,  excellent  stability  and  handling  qualities  in  connection  with  the  afterburn¬ 
er,  intake  mass  flow  flexibility,  acceptable  compatibility  with  inlet  distortion,  good  flow  conditions  co 
reduce  afterbody  drag,  and  maneuverable  control  system. 

All  this  may  be  at  present  obtained  with  variable  geometry  of  the  engine  in  several  components. 

A  variable  cycle  engine  must  have  the  ability  to  make  significant  changes  to  its  thermodynamic  cycle, 
at  a  particular  thrust  and  flight  condition,  without  incurring  a  performance  and  weight  penalty  which 
would  cancel  the  value  of  variability.  The  variable  geometry  components  offer  advantages  as  regard  the 
flexibility  of  the  propulsion  system,  but  it  becomes  mandatory  to  have  an  efficient  control  to  reduce  in 
time  the  unsteady  flow  originated  and  pressure  waves  travelling  up  and  downstream  along  the  engine.- 

Supersonic  V/STOL  fighters  require  propulsion  systems  which  produce  thrust  well  in  excess  of  aircraft 
weight.  The  powered  lift  requirements,  plus  the  flight  performance  requirements  of  the  fighter  mission, 
result  in  extensive  compromise  in  variable  cycle  and  geometry  for  obtaining  efficient  fuel  utilization  at 
both  supersonic  and  subsonic  conditions,  high  thrust  fur  combat,  good  airframe  integration  chaiacteristics, 
rapid  thrust  response  for  hover,  high  bleed  rates  for  control. 

The  intercept  mission  emphasizes  high  power  performance  for  vertical  take-off,  maximum  power  climb,  super¬ 
sonic  dash,  and  supersonic  combat.  The  subsonic  surface  surveillance  mission  emphasizes  low  power  fuel 
utilization  efficiency  in  the  long  range  subsonic  cruise  out  and  back,  and  long  loiter  on  station.  Future 
V.STOL  fighters  require  high  specific  thrust  (afterburning)  engines  to  best  include  multimission  objectives 
for  transonic/supersonic  cruise  and  combat  and  subsonic  loiter.  As  subsonic  and  supersonic  combat  specific 
power  levels  increase,  variable  geometry  exhaust  systems  are  required  for  a  wide  range  of  cruise/accelera¬ 
tion  and  maneuverability  transient  conditions..  Exhaust  systems  capable  of  deflecting  or  turning  the  ex¬ 
haust  gas  to  achieve  vertical  and  short  take  off  and  landing,  require  an  external  variable  area  to  provide 
a  maximum  efficiency  thrust  vectoring  system,  by  utilizing  a  variable  aft  expansion  ramp  for  a  range  of 
upward  or  downward  vertical  thrust  components. 

The  engine  generates  external  forces  that  affect  the  drag  and  lift  of  the  airplane.  The  drag  produc¬ 
tion  is  due  to  either  viscous  losses  and  shock  losses.  The  engine  induce  large  pressure  variations  in  the 
region  in  front  of  the  engine  and  behind  the  engine  that  influences  the  aerodynamic  properties  of  the  air¬ 
plane,  including  lift  and  pitching  moments.  In  the  front  we  have  sinks  that  accelerate  the  flow;  the  in¬ 
terference  between  engine  flow  and  external  flows  extends  downstream  of  the  engine.  From  the  other  hand, 
the  effet  of  the  flow-field  produced  by  the  airplane  on  the  engine  performance  is  strong  for  engines  im¬ 
bedded  in  the  fuselage,  as  normally  for  fighters.  For  flight  control  purpose,  the  aero/propulsion  forces 
on  aircraft  have  to  be  accounted,  to  ensure  that  the  performance  predicted  for  each  of  the  various  ele¬ 
ments  (i.e.,  inlet,  exhaust  system  airframe,  and  turbomachinery)  are  properly  integrated  to  permit  an 
adequate  flight  control. 

The  complexity  of  fighter  powerplant  control  requirements,  particularly  at  tht  reheat  end  of  the  sys¬ 
tem,  is  the  primary  reason  for  choosing  a  digital  system  in  engine  control.  Tht  p' Imary  purpose  of  the 
propulsion  control  system  is  to  operate  the  engine  and  inlet  within  known  median 'cal  and  aerodynamic  lim¬ 
its,  while  providing  the  desired  thrust  performance  during  all  flight  conditions  it  minimum  level  of  fuel 
consumption.  Recently,  diagnostic  functions  have  been  added  to  determine  engine  condition  and  necessary 
maintenance  actions. 

Variable  geometry  engines  require  extensive  integration  and  more  sensing  computation  and  actuation  func¬ 
tions,  with  electronic  control.  Based  on  the  general  trend  toward  more  extensive  use  of  digital  systems, 
the  future  fighter  aircraft  will  be  flcwn  almost  entirely  by  an  integrated  avionic  system.  In  this  ap¬ 
proach,  all  the  subsystem  functions,  such  as  guidance,  flight  control,  communications,  displays,  weapon 
delivery,  and  propulsion  control,  will  be  combined  in  a  central  micro-processing  unit.  The  common  link 
between  the  central  processor  and  all  the  subsystems  will  be  a  digital  data  bus,  with  all  computations 
highly  automated  according  to  the  performance  requirements,  Ref.  3. 

FACTORS  INFLUENCING  VARIABLE  GEOMETRY  INTAKE  DESIGN  FOR  FIGHTER  AIRCRAFT 

In  the  case  of  variable  geometry  supersonic  intake,  the  design  must  be  a  compromise  approaching  the 
optimum  flow  to  the  engine,  with  minimum  efficiency  loss  and  drag  increase  in  the  flight  speed  range. 

In  respect  to  the  fixed  inlet,  figure  3,  the  two  dimensional  variable  inlet  has,  for  example,  horizontal 
ramps  (three  compression  ramps  and  a  diffuser  ramp),  figure  4,  and  may  have  diverter,  translating  spike, 
hinged  lower  cowl  lip,  to  provide  a  uniform  inlet  flow-field  at  high  angle  of  attack  at  supersonic  speed, 
and  to  avoid  engine  surging  and  blade  vibration. 

Because  of  shock  waves,  friction  and  flow  separation,  the  intake  pressure  recovery,  defined  as  en¬ 
gine  face  mean  total  pressure/total  pressure  achieved  in  adiabatic  isoentropic  compression,  is  less  than 
unity.  The  momentum  lost  approaching  intake  is  the  spillage  drag,  due  to  the  diverted  excess  flow.  Some 
of  this  lost  moment  may  be  recovered  by  the  cowl  suction.  Other  intake  drags  are  due  to  boundaiy  laver 
bleed,  by-pass,  environmental  control  system,  and  waves. 

External  compression  inlets  when  aircraft  missions  require  extended  flight  at  Mach  number  m  the  2.0 
to  3.0  range,  external  compression  inlet  applications  become  less  desirable  in  spite  of  their  inherent 
stability  and  simplicity,  figure  5.  At  Mach  number  3.0,  for  example,  a  typical  two-dimensional  external 
compression  inlet  might  have  a  final  compression  ramp  angle  of  about  40°,  with  a  cowl  lip  angle  of  approx- 
mately  25°  to  30°.  The  cowl  drag  which  results  from  this  high  lip  angle  can  more  than  offset  the  pressure 
recovery  potential  of  the  design.  In  this  case,  figures  5  and  6,  the  geometrical  configuration  of  the  air 
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intake  is  approaching  an  isentropic  compression  ramp,  according  the  Prandtl  -  Meyer  theory.  The  ramp  profile 
realizes  an  "infinite"  summation  of  small  pressure  increase  Ap,  a  condition  for  which  the  highest  pressure 
recovery  is  reached.  The  choice  of  a  typical  isentropic  compression  ramp  depends  upon  this  advantage, 
figure  7.  For  a  given  inlet  diameter,  we  have  obtained,  figure  8,  contours  and  focuses  of  isoentropic 
ramps,  for  M  =  2.0,  2.5  and  3.0.  The  air  intake  is  two-dimensional,  as  flow  and  cross-sectional  area, 
up  to  critical  conditions,  after  which  is  undergoing  gradual  modification  in  the  relatively  long  subson¬ 
ic  duct,  reaching  the  front  engine  circular  section.  At  M  =  2.15,  the  focus  coincides  with  the  air  intake 
inferior  cowl  lip,  so  that,  the  configuration  is  characterized  by:  a  compression  wave  interesting  a  con¬ 
stant  angle  segment  OC,  another  compression  wave  along  the  isoentropic  profile,  and  a  normal  compression 
wave  at  the  critical  cross  section,  where  the  subsonic  duct  is  starting. 

This  simple  air  intake  configuration  is  adapted  to  other  flight  Mach  numbers.  As  in  the  two  dimensional 
inlet  of  figure  9,  where  a  small  amplitude  compression  wave  system  is  determining  an  external  supersonic 
compression  air  intake,  both  ramps  are  hinged  in  one  or  more  points,  and  the  intermediate  boundary  layer 
bleed  is  variable,  to  make  possible  an  acceptable  operation  in  a  range  of  flight  Mach  numbers.  Xr.  figure 
10,  an  air  intake  for  M  =  2.5  and  70  000  N  dry  thrust  engine  is  represented.  The  isoentropic  ramp  is  fol¬ 
lowed  by  a  boundary  layer  bleed  and  a  second  ramp;  a  schematic  nozzle  control  is  indicated  at  the  engine 
exhaust.  A,  B  and  C,  are  the  ramp  hinge  points.  It  may  be  observed  on  figure  11  that  configurations  more 
or  less  close  to  the  ideal  required  conditions  are  deduced  by  rotating  the  first  ramp  around  the  hinge 
points  A  and  C.  It  is  obvious  that  this  accomodation  is  happening  with  high  energetic  losses,  in  other 

words,  with  less  pressure  recovery.  On  figure  11,  it  is  also  indicated  the  hinge  point  B,  around  which 

the  second  ramp  is  rotating.  Another  problem  emerging  from  figure  8  is  regarding  focus  position.  Each  ramp 
has  its  own  focus;  and  focus  -  inlet  cowl  lip  coincidence  is  the  condition  of  best  operation,  in  other 
words,  a  more  regular  pressure  recovery  as  shown  in  figure  12,  Ref.'  10.  Here,  the  flow  is  critical  at  that 
point,  at  which  the  pressure  recovery  is  a  maximum  for  maximum  absolute  airflow  W.  This  condition  is  nor¬ 
mally  characterized  by  normal  shock  location  at,  but  just  inside,  the  cowl  lips.  When  the  normal  shock 
moves  ahead  of  the  cowl,  the  absolute  mass -flow  rate  is  reduced  while  the  pressure  recovery  is  depending 
on  the  inlet  design.  As  it  is  known,  this  entire  region  of  reduced  mass  flow  is  called  the  subcritical 
region.  Conversely,  the  normal  shock  may  be  drawn  down  into  the  diffuser  passage,  causing  a  reduction  in 
pressure  recovery  but  no  increase  in  absolute  airflow  rate  above  the  critical  value,  i.e.,  the  known  su¬ 
percritical  operation.  Referring  to  figure  8,  subcritical,  critical  and  supercritical  conditions,  are  re¬ 
spectively  for  M  »  2.0,  2.5  and  3.0.  It  is  possible  to  obtain  the  optimum  condition  for  an  air  intake, 
when  the  required  engine  weight  flows,  corresponding  to  various  flight  speeds  and  altitudes,  and  the  sec¬ 
ondary  and  main  flow  distribution,  are  known.  Referring  to  these  data,  increasing  and  decreasing  air 

flows,  with  corresponding  secondary  flow  control,  are  obtained  through  ramp  rotations  around  the  hinge 
points  A  and  B  for  a  variation  of  bleed  capture  cross  section.  A  more  sensitive  flow  control  is  obtain¬ 
able  with  a  bleed  door,  figure  10.  Using  a  variable  geometry  scheme,  the  entrance  region  is  changing  in 
such  a  way  that  the  correct  stream  tube  is  captured  for  each  flight  Mach  number  and  value  of  the  static 
temperature.  In  this  case,  it  is  convenient  to  install  the  inlet  in  a  region  where  the  local  Mach  number 
is  lower  than  the  free  stream  Mach  number.  The  variation  of  inlet  geometry  can  be  designed  to  produce  var¬ 
iations  of  Aq  and  Ajjj.jj,  figure  13,  Ref.,  11.  Am^n  fixes  the  transition  from  supersonic  to  subsonic  flow. 

The  external  compression  axisymmetric  inlet  is  shown  in  figure  14,  with  a  continuous  compression.  Condi¬ 
tions  may  be  tranlated  to  mixed,  external  and  internal  compression  with  variable  geometry  and  spike  trans¬ 
lation. 

The  air  flow  is  slowing  down  on  the  subsonic  duct,  depending,  figure  10  and  15  on  the  conditions  estab¬ 
lished  by  the  front  ramp  and  the  following  bleed  chamber.  The  relative  pressure  is  also  function  of  the 
air  going  thi-ough  the  bleed,  so  that  the  diffuser  geometry  depends  upon  this  parameter,  as  ic  is  seen  in 
figure  16  for  subsonic  and  supersonic  flow.  The  relative  geometrical  characteristics  are  represented  on 
figure  17.  Tn  the  section  downstream  of  the  first  ramp,  the  open  door  following  the  supersonic  profile  is 
determining  a  slip  brutal  deviation  for  the  pressure  increase  from  supersonic  to  subsonic  regime.  The 
boundary  layer  separation  is  avoided  by  air-breathing  through  the  bleed  fissure.  Bleed  operation  is  rep¬ 
resented  on  figure  15,  where  e,  cjj,  n0  and  n,  are,  respectively,  internal  flow  coefficient,  bleed  flow 
coefficient,  bleed  efficiency,  and  air  intake  efficiency. 

The  intake  drag  in  supersonic  flight  exerts  a  significant  influence.  It  can  be  regarded,  figure  18,  as 
having  two  components:-  that  which  arises  from  the  deflection  of  air  through  the  shock  wave  system  up¬ 
stream  of  the  intake  lips,  and  that  stemming  from  the  positive  pressure  on  such  forward  facing  surfaces 
of  the  intake.  The  relative  total  drag  is  varying  as  the  intake  geometry  is  changed. 

Various  types  of  external  compression  axisymmetric  inlets  are  illustrated  on  figure  19.  Ferri,  Refs.  13 
and  14,  did  a  great  deal  research  on  all  external  compression  inlets.  Although  the  total  -  external  com¬ 
pression  inlets.  Although  the  total  -  pressure  losses  of  external  compression  inlets  decrease  as  the  num¬ 
ber  of  oblique  shocks,  figure  20,  Ref.  10,  is  increased,  it  has  been  found  in  practice  that  the  use  of 
more  than  two  shocks  offers  greater  flow  complication.  In  the  completely  "isentropic"  compression,  fig- 
gure  10,  an  oblique  shock  of  finite  amplitude  is  initially  generated  by  the  sharpest  practical  leading 
edge  and  the  subsequent  conpiessijn  is  isentropic.  In  this  type  of  compression,  a  compression  limitation 
exists,  as  shown  on  figure  19.  The  static  pressure  rise  across  the  strong  shock  must  equal  the  rise 
through  the  isentropic  zone  and  reflected  wave  and  thus  balance  across  the  vortex  sheet.  Ref.  15.  The 
maximum  isentropic  and  theoretical  normal  shock  and  two  and  three  shock  external  compression  inlets  re¬ 
coveries  are  presented  in  figure  20.  Instabilities  is  normally  ascribed  either  to  the  entering  shear 
plans,  after  Ferri,  figure  21,  oi  tc  shock  wave-boundary  layer  interaction  leading  to  flow  sep.  ration  on 
the  supersonic  compression  surface,  figure  22.  But,  many  other  variables  are  thought  tc  significantly  af- 
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feet  instability  phenomena.  Some  intakes  of  recent  concern  exibits  two  phase  of  instability.  After  a  small 
reduction  in  mass  flow,  a  low  amplitude  oscillation,  the  so-called  "little"  buzz,  suddenly  appears,  while 
further  throttling  initiates  "big"  buzz.  The  latter  is  of  much  larger  amplitude  than  little  buzz,  although 
the  frequency  is  similar.  A  large  stable  sub -critical  margin  tends  to  imply  a  high  pre-entry  drag,  figure 
23.  The  basic  principle  is  to  devise,  Ref.  10,  a  range  of  intake  geometries  such  that  as  many  as  possible 
of  the  factors  thought  to  influence  instability  phenomena  remains  constant,  varying  in  a  systematic  manner 
the  supersonic  compression  field,  through  ramps,  in  terms  of  the  total  pressure  gradient  falling  across 
the  cowl  lip  and  of  the  deliberate  employment  of  particular  combinations  of  shocks. 

Computer  programs  for  calculating  the  flow  field  in  three  dimensional  axisynimetric  or  two-dimensional 
inlets  have  been  prepared.  A  program  limited  to  applications  in  which  the  bow  shock  wave  does  not  inter¬ 
sect  the  cowl,  so  that  internal  shock  wave  intersections  do  not  occur,  is  presented  in  Ref.  16.  In  order 
to  facilitate  the  computation,  the  flow  field  behind  the  shock  wave  is  broken  into  several  regions  bounded 
by  shock  waves,  as  shown  in  figure  24.  The  standard  procedure  adopted  is  the  method  of  characteristics. 

At  supersonic  flight  speeds,  an  important  operating  mode  of  an  air  intake  is  the  mode  in  which  the  termi¬ 
nal  shock  occurs  ahead  of  the  cowl  lip  of  the  diffuser.  The  compression  shock  can  be  the  result  of  differ¬ 
ent  causes,  such  as  flow  throttling  by  the  engine,  insufficient  throat  area,  or  change  of  flow  direction 
at  the  cowl  lip  by  a  turning  angle  greater  than  critical.  At  the  stagnation  surface,  the  flow  pattern  be¬ 
comes  complex  because  of  interaction  between  the  chock  wave  and  the  boundary  layer,  and  flow  separation 
zones  are  produced. 

External  compression  with  variable  geometry  inlet  -  The  concept  in  figures  4  and  5,  relative  to  the 
F-15  inlet  provides  an  external  compression,  with  a  system  of  three  oblique  and  one  normal  shock  ahead  of 
the  cowl.  Refs.  5,  6  and  7.  Boundary-  layer  bleed  is  provided  through  porous  regions  on  the  second  and 
third  ramps  (15%),  through  the  throat  slot  (70%),  and  through  the  side  plates  (15%).  The  bleed  is  exhaust¬ 
ed  on  top  of  the  inlet.  A  by-pass  system  is  included  for  inlet -engine  matching  at  different  speeds  and 
altitudes.  By  rotating  the  entire  forward  ramp,  the  capture  area  is  changed. 

Fixed  and  variable  capture  area  inlets  were  tested  in  the  F-15  program.  The  benefits  of  the  relative  shock 
system  behaviour,  as  it  influences  inlet  total  pressure  recovery  and  instantaneous  total  pressure  distor¬ 
tion,  are  depicted  in  figure  25.  The  shape  of  inlet  sideplates  was  investigated  to  determine  the  effect  on 
inlet  behaviour.  Blunt  lip  shapes  of  the  lower  cowl  were  tested  for  improving  recovery  and  distortion  and 
delaying  lip  separation  at  high  angles  of  attack  at  subsonic  speeds. 

The  F-15  movable  inlet  ramps  and  air  by-pass  door  are  controlled  by  an  electronic  computer  and  hydrau¬ 
lically  operated  actuators.  The  computer  receives  signals  from  sensors  that  measure  flow-field  conditions 
ahead  and  within  the  inlet  and  provides  signals  to  the  three  actuators  that  set  the  ramps  and  by-pass  door 
to  their  proper  position,  figure  26. 

More  in  general,  the  geometry  of  inlet  is  variable,  through  mixed-compression  systems,  to  provide  adequate 
transonic  airflow  to  satisfy  the  engine  airflow  demand. 

Improvements  in  electronic-control  technology  is  providing  reliable  control  systems  to  meet  turbine 
engine  requirements,  including  increased  accuracy,  multiple  control  loops,  and  more  communication  links 
between  the  propulsion  systems.  Technological  advances  is  making  control  system  designed  around  a  prime 
reliable  digital  electronic  computer  which  meets  the  control  requirements  for  the  advanced  engines  and 
eliminates  the  need  for  a  hyd^omechanical  control.  Electronic  propulsion  control  are  currently  being  ap¬ 
plied  in  several  of  the  latest  military  aircraft. 

A  design  of  an  intake  control,  considering  changes  through  the  engine  as  flight  speed,  altitude  and 
climatic  conditions,  is  reported  synthetically  in  Appendix. 
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Fig.  1  -  Mission  profile  for  the  ground  attack  aircraft. 


Fig.  2  -  Variable  geometry  two-shaft  by-pass  ratio  powerplant. 
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Fig.  3  -  Inlet  spoilage  flow  (schematic). 
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6  -  Two-dimensional  isentropic  flow 
(Prandtl -Mover  Theory) 
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Fig.  h  -  F-15  inlet  control  system. 
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Effect  of  ramp  geometry  on  recovery.- 
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Fig.  8  -  Contours  and  focuses  of 
isentropic  ramps. 


Fig.  9  -  External  compression  two- 
dimensional  inlet. 


Fig.  10  -  Air  intake  for  M  =  2.5 
and  70  000  N  dry  thrust  engine 
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<  «-  Fig.  15  -  Two-dimensional  inlet  performances. 
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(CL)  SHORT ASihMETRIC  DIFFUSER.  compression  intakes. 


Fig.  18  -  Cowl  lip  configurations. 

2  SHOCK 


IHCEItSECriOti  ZONE 
(COWL  REMOVED) 


Fig.  19  -  External  compression  inlet. 


Fig.  20  -  Maximum  pressure  recovery 
|  (all  external  compression). 
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DEMOTION  DE  LOIS  OPTDWfS  DE  MDNTEE  EN 
REGIE  D'UN  TURBO, REACTEUR 

C,  BARROUIL 

IngSnieur  au 

CBTTRE  D'ETUDES  ET  DE  RECHERCHES  DE  TOULDUSE 
DEpartement  d'Automatique 
31055  Toulouse  CEdex  France 


Resume : 

On  peut  distinguer  deux  modes  de  fonctionnement  pour  un  turbo  reacteur  simple  corps  sans  post¬ 
combustion:  -changement  de  point  de  consigne 

-regulation  d'un  point  de  consigne 

Nous  cherchons  a  realiser  un  changement  de  point  de  consigne  rapide  nais  assurant  des  marges  de 
securite  convenables  au  cours  de  la  transition  et  laissant  en  fin  de  transition  le  moteur  dans  un  etat 
pratiquement  stabilise. 

Les  commandes  du  moteur  sont  le  debit  carburant  et  la  section  de  tuyere. Elies  sont  delivrees  par 
des  actuateurs  commandes  eux-memes  par  un  calculateur  numenque  ou  analogique  ou  electro-hydromecanique. 
Nous  ne  cherchons  pas  les  lois  de  commande  des  actuateurs  mais  directement  leur  sortie  c'est  a  dire  le  de¬ 
bit  carburant  et  la  section  de  tuyere  optimaux.Les  lois  trouvees  seront  les  consignes  affichees  su-  les 
actuateurs. 

Notations: 

N=regime  de  la  turbine 
T5=temperature  devant  la  turbine 
M=marge  de  pompage  du  compresseur 
F=poussee  du  moteur 
C=debit  carburant 
S=section  de  tuyere 

A(N,C,S)=d(N)/dt  =  dynamique  de  la  turbine 


Nous  supposons  l'existence  d'un  modele  mathematique  du  moteur  et  nous  adoptons  une 
le  souci  de  securite  apparait  comme  une  contrainte  ,  la  rapidite  de  la  transition  comme  une 
optimiser . 


formulation  od 
performance  a 


1-1  Modele  mathematique  du  moteur 

Nou*’  supposons  conr.u  un  ensemble  d'equations  permettant  d'obter.ir  a  l'issue  de  calculs  plus  ou 
moms  complexes  les  valeurs  de  (A,T5,M,F)  quand  on  connait  (N,C,S)  et  les  conditions  de  vol. 

II  est  important  de  remarquer  que  si  la  complexity  du  modele  est  ir.differente  ,  la  methode  pre¬ 
sentee  n'est  applicable  que  s'il  n'y  a  qu'une  seule  equation  differentielle  (ordinaire) .On  ne  pourra  done 
pas  traiter  le  cas  des  moteui's  double  corps  ni  prendre  en  ccmpte  certains  effets  pneumatiques  ou  thermi- 
ques. 


1-2  Contraintes 


Elies  traduisent  les  marges  de  securite  a  observer: 


T5(N,C,S)<  T5mftX(N) 
M(N,C,S)>  M 


S>.  S  .  1 

*  min  I 

S<  S  f 
N  max  J 


regime  maximal 
temperature  maximale 
mirge  de  pompage 

butees  de  tuyere 


Les  b  dernieres  contraintes  definissent  pour  U  donnS  un  domame  admissible  U(N)  de  (C,S)  . 

1-3  Criteres  d'optimisat'cn.- 

II  est  legitime  de  songer  en  premier  lieu  a  des  criteres  de  temps  minimum  par  exemple  :■  ob- 
tention  de  95%  du  regime  affiche  (ou  de  la  poussee  correspondante)  en  temps  minimum. 

Avec  ce  type  de  critere  on  obtient  en  fin  de  transition  des  accelerations  de  turbine  importan- 
tes  et  l'on  observe  aussitou  apres  un  depassement  de  regime. 

Nous  preferons  defmir  un  critere  tel  que  le  moteur  soit  pratiquement  stabilise  en  fin  de  tran¬ 
sition.  Poiir  cela  on  peut  fixer  8  priori  la  duree  T  de  Involution  ,  assez  grande  pour  que  le  regime  sta¬ 
bilise  puisse  etre  atteint  ,  et  en  imposant  de  plus  que  le  regime  ns  depasse  jamais  la  consigne  N*. 

Sur  l'horizon  (0,T)  on  ootimisera  le  critere: 

rT 

I=  f  F  (it 

J0 

Ce  critere  est  raisor.nable  quand  on  envisage  une  montee  en  regime. II  est  discutable  pour  une  re¬ 
duction  de  regime. Nous  verrons  plus  loin  que  la  methode  preposee  est  applicable  avec  tout  critere  de  type 
integrate.  II  est  done  possible  de  changer  de  critere  si  l'on  veut  optimise!-  une  reduction  de  regime. 
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1-k  Synthese  de  la  formulatio i  pour  une  monte p  en  regime 
Etant  donne  le  systeme  deer it  ^ar : 


d(H)/dt  =  A(N,C,S) 
F(N,C,S) 
T5(N,C,S) 
M(N,C,S) 

C 

S 


maximiser  le  critere  I 


fT 

Jo 


equation  d'etat 
poussee 

temperature  devant  turbine 
index  de  stabilite  du  moteur 
debit  carburant 
section  de  tuyere 


sorties  du  systeme 


variables  de  conmande 


’(N.C.Sj  dt 


o5  T  est  fixe  a  priori  , 


en  respectant  les  contraintes:- 

N<N*<  N 

max 

T5(N,C,SX  T5 

’  max 

M(N,C,S)>  M  . 

’  mm 

S  .  x;S$S 
min'-  '  max 


pour  N  donne  (C,S)  appartient  a  U(N)’ 


II.  -  RESOLUTION  DU  PROBLEHE 


II- 1  Utilisation  du  prineipe  du  maximum 

Nous  appliquons  le  prineipe  du  maximum  de  Pontrjagin. 

II  consiste  a  exprimer  qu'a  l'inscant  t  sur  (0,T)  ,  il  existe  un  coefficient  ip  (systeme  adjoint) 
tel  que  les  commandes  optimales  (C,1>)  a  cet  instant  maximisent  ,  sous  reserve  des  diffSrentes  contraintes 
le  Hamiltonien  :• 

H  ( C ,  S  i  N  ,4> )  =  F(N,C,S)  +  A(N,C,S) 

Ce  Hamiltonien  doit  etre  considere  comme  une  fonction  de  (C,S)  oi  N  et  1(1  sont  des  parametres 
connus  a  l'ir.stant  t. 

Le  prineipe  du  maximum  apparait  comme  la  recherche  d'un  comr—omis  entre  la  maximisation  immedia¬ 
te  de  la  poussee  F  et  le  choix  d'une  variation  de  N  (choix  de  A)  qui  permettra  aux  instants  suivants  d'ob- 
tenir  une  poussee  interessante. 

On  demontre  que  ^  obeit  a  une  equation  differentielle  oil  figurent  les  derivees  par  rapport  a  N 
de  F  ,  A  et  des  contraintes  T5  et  M  . 

Cette  equation  permet  de  demontrer  que  le  maximum  du  Hamiltonien  est  constant  dans  le  temps  a  con¬ 
dition  que  le  pre  Jerae  soit  stationr.aire  ,  e'est  a  dire  que  la  solution  ne  depende  pas  du  choix  de  l'ins- 
tant  0. C'est  evidemment  le  cas  dans  notre  probleme. 

On  peut  resumer  les  resultats  theoriques  essentiels  pari¬ 
es)  maximise  H(C,S  ;  N,\(/)  avec  (?,§)£  U(N) 

H(C,S  ;N,ij/)  =  constante 


I 1-2  Resolution  graphique 

be  Hamiltonien  peut  s ' interpreter  comme  le 
produit  scalaire  des  vecteurs:' 


Portons  ces  deux  vecteurs  dans  un  plan.Au 
domaine  admissible  U(N)  de  (C,S)  on  peut  associer  le 
domaine  /(N)  de  Y  .Connaisant  (C,S)  on  en  deduit 
Y  et  reciproquement.  (cf.  figure  1) 


Comme  (C,S)  maximise  le  produit  scalaire 
0X.0Y  le  point  ^  associe  a  (^,1=)  est  le  point  du  do¬ 
maine  y(N)  qui  a  la  plus  grande  projection  sur  le 
vecteur  OX.  (cf.  figure  2) 

On  sait  done  trouver  geometriquement  (£,§) 
connaissant  (N,i|<). 

Le  pied  de  la  perpendiculaire  issue  de  $ 
sur  OX  est  H  et  ?H  coupe  I'axe  des  abscisses  en  F. 

En  jouant  sur  les  proprietes  du  produit  sca¬ 
laire  on  trouve  successivement  que. 

H(6v,'s  ;  N,1^)=0X.0Y  =  OX. OH  =  CX.OF  =  01. OF 

L'abscisse  de  F  est  egale  au  maximum  du  Ha¬ 
miltonien.  C'est  i  one  une  constante  et  le  point  F  est 
done  fixe  au  cour->  de  la  transition. 


,A  A  . 

si  or.  connait  F  on  calc~e  C,S;  en  mer.ar.t  de  i  une  tange.rte  au  domaine  y(N). 
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A  priori  il  existe  au  moins  deux  tangentes. Pour  notre  application  le  domaine  y(N)  a  toujovri.  ete 
convexe:Deux  tangentes  seulement  sont  possibles. Les  developpements  theoriques  montrent  que  pour  une  mon- 
tee  en  regime  il  faut  choisir  celle  qui  donne  dN/dt  pcsitif.Le  bon  sens  le  laissait  pressentir. 

Le  probleme  est  done  de  trouver  le  point  F. 

Si  on  postule  que  le  regime  de  consigne  N't  est  atteint  et  stabilise  en  fin  de  transition  alers: 
IH$,$  ;  N*", 4i)=F(N*)C ,S)+y A(N*",C,S j 
avec  A(N*,C,S)=0 

Le  maximum  du  Hamiltonien  ,  e'est  a  dire  l'abscisse  de  F  ,  est  egal  a  la  poussee  stabilisee  maxi¬ 
mum  du  regime  de  consigne. Des  conditions  theoriques  d’optimalite  dites  "conditions  de  transversalite"  con- 
firment  le  postulat  sous  reserve  que  le  domaine  y(N  )  soit  convexe  et  que  le  riximum  de  poussee  stabilisee 
soit  une  fonction  croissante  du  regime. 

III.  -  METHODE  PRATIQUE  DE  CONSTRUCTION  DES  1^13  DE  COMMANDE 

Pom-  plusieurs  valeurs  do  N  :N,  ,Nt . ,N  on  exploite  le  modele  mathematique  donnar.t  A.F.T5 

et  M  afin  de  construire  les  frontieres  d<.s  domaines^fN,  )  .^(Ni)  ,  ...  ,  y(N  )  que  l'on  gradue  en  C  et  S. 
Ce  calcul  se  fait  en  explorant  par  exemple  les  valeurs  possibles  de  C  pour  §afixS  et  en  surveillant  les  va¬ 
leurs  des  contraintes. 

On  reporte  ces  frontieres  sur  un  raeme  systeme  d'axes  rectangulaires  (cf.  figure  3) 


Pour  calculer  les  lois  de  montee  au  regime  N*  on  fixe  le  point  F  comme  etant  le  point  de  poussee 
maximale  au  regime  stabilise  N*.0n  mene  ensuite  les  tangentes  issues  de  F  aux  frontieres  des  domaines/(N) 
et  on  sSlectionne  celles  qui  donnent  un  point  de  tangence  od  A>0.  A  A 

On  lit  les  graduations  et  on  construit  ainsi  les  lois  de  commande  en  boucle  fermee  C(N)  et  S(N). 

IV.  -  AUTRES  APPLICATIONS  DE  LA  METHODE 

La  methode  proposee  ne  fail  aucune  hypothese  srn  les  fonctions  A,F,T5,M.Elle  est  applicable  a  tout 
probleme  se  posant  de  la  faqon  suivante: 

-probleme  stationnaire 

-une  seule  equation  differentielle 

-horizon  d 'optimisation  fixe  a  priori 

-critere  de  type  integral 

-diverses  contraim  es  de  type  instantane 


V.  -  CONCLUSION 

Le  principe  du  maximum  de  Pontrjagin  nous  a  permis  de  calculer  des  lois  de  commande  en  boucle  fer¬ 
mee  pour  un  reacteur  simple  corps. Cette  methode  ,  simple  de  mise  en  oeuvre  ,  peut  etre  interessante  au  ni¬ 
veau  du  bureau  d'etudes  notamment  pour  evaluer  a  partir  d'un  modele  mathematique  les  performances  dynami- 
ques  que  l'on  peut  attendre  d'un  moteur  en  projet.- 
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DISCUSSION 


B.J.Cocking,  UK 

Could  you  please  explain  how  changes  on  surge  margin  due  to  effects  such  as  inlet  distortion,  affect  your  work. 
Author’s  Reply 

At  the  time  when  we  carried  out  this  study,  we  had  no  suitable  compressor  model  available.  Therefore,  we  were 
unable  to  investigate  this  aspect. 

However,  the  following  can  be  said 

This  method  provides  control  laws  which  permit  a  specific  minimum  surge  limit  to  be  adhered  to  during  build-up 
of  speed,  provided  that  no  inlet  distortion  occurs. 

If  an  inlet  distortion  is  present,  this  must  either  be  determined  and  the  control  laws  amended  accordingly,  or  the 
distortion  is  ignored,  in  which  case  a  sufficient  surge  margin  must  be  provided  in  order  to  be  able  to  “catch”  the 
inlet  distortion  even  in  the  most  unfavourable  case  (which  admittedly  will  penalize  effect  on  the  performance  under 
normal  operation). 

In  the  case  where  the  inlet  distortion  can  be  measured,  one  has  two  possibilities  of  action: 

-  The  control  law  parameters  must  in  all  cases  be  set  in  accordance  with  the  flight  conditions  (inlet  temperature  and 
pressure).  The  parameters  can  also  be  determined  m  accordance  with  an  inlet  distortion  index.  The  inlet  distor¬ 
tion  measurement  is  just  as  much  a  computer  input  as  the  speed  N  and  flight  conditions  P0  and  T0. 

-  Control  laws  determined  for  operation  without  inlet  distortion  can  be  corrected  by  control  laws  for  transient 
conditions,  which  then  act  as  “trim”.  These  control  laws  can  only  be  determined  by  the  proposed  method. 


R.D.Matulka,  US 

Have  you  considered  mass  flow  as  a  state  variable? 

Author’s  Reply 

No,  namely  for  the  following  reasons: 

If  a  state  variable  is  added,  the  method  is  inapplicable,  as  the  geometric  solution  to  the  problem  no  longer  gives 
the  point  of  solution,  but  a  senes  of  points  which  includes  the  point  of  solution. 

-  The  dynamics  of  this  state  vaiiable  are  appreciably  quicker  than  those  of  the  turbine  and  the  actuators  would  not 
be  in  a  position  of  being  able  to  issue  commands  which  would  take  these  dynamics  into  account.  It  is  better  to 
consider  the  flow  as  being  permanently  stabilised,  and  this  is  accomplished  by  resolving  specific  implicit  equations 
in  the  engine  model. 

This  approximation  appeal's  to  us  reasonable  in  as  far  as  the  determined  control  laws  do  not  contain  any  very  rapid 
change  in  the  fuel  flow  or  nozzle  cross-section. 
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MODE  CONTROL 

A  FLEXIBLE  CONTROL  CONCEPT  FOR  MILITARY  AIRCRAFT  ENGINES 

by 

Dr. -Ing. Klaus  Bauerfeind 
Head  of  Performance  and  Control 
MOTOREN-  UND  TURBINEN-UNION  MUNCHEN  GMBH 
665  Dachauer  Str.,8000  Miinchen  50,  Germany 


SUMMARY 

It  can  be  shown  that  the  control  laws  of  military  engines  with  their  extremely  varying 
flight  and  operational  conditions  have  usually  to  be  tailored  around  the  most  critical 
conditions  in  order  not  to  cause  damage  to  the  engine  and  also  not  to  endanger  the  mission 
flown.  It  follows  that  under  the  majority  of  operational  conditions  the  engine  is  controlled 
with  unnecessarily  large  safety  margins.  This  in  turn  means  that  it  carries  around  either 
too  many  compressor  stages  or  operates  in  regions  of  the  characteristics  which  are  not 
optimal  in  terms  of  fuel  consumption. 

Mode  control  offers  a  concept  where  these  extreme  conditions  are  registered  and  signalled 

to  an  electronic  control  system.  This  control  system  then  trims  and  overrides  the  normal 

control  laws  in  order  to  provide  the  necessary  margins  required  for  safe  operation  so  long 

as  the  eytreme  condition  prevails. 


INTRODUCTION 

Control  systems  of  aero  gas  turbine  engines  have  always  had  a  certain  influence  on  the 
overall  economics  of  the  propulsion  system.  With  modern  military  engines  equipped  with  an 
afterburner  and  a  number  of  variables  such  as  compressor  stators  and  air  bleeds  this  poten¬ 
tial  has  further  increased.  This  potential  is  a  function  of  the  number  of  engine  trims 
available  on  a  particular  engine  and  the  spectrum  of  different  performance  and  handling 
requirements  for  this  engine. 

Studies  nave  shown  that  such  a  sound  potential  is  available  for  instance  in  the  case  of 
most  modern  engines  for  military  fighter  aircraft.  For  an  engine  of  this  type  the  prin¬ 
ciple  of  Mode  Control  is  explained  in  a  qualitative  way.  The  main  objective  of  Mode  Control 
can  be  described  as  "using  the  correct  trim  at  the  right  time  and  only  at  the  right  time" 
in  order  to  avoid  costly  compromises.  In  order  to  achieve  this  goal  two  requirements  must 
be  met 

clear  indication  at  any  instance  m  time  of  what  is  required  from  the  engine 
availability  of  engine  trims  in  order  to  cope  with  the  requirements. 


TYPICAL  OPERATIONAL  PERFORMANCE  AND  HANDLING  REQUIREMENTS  FOR  A 
MODERN  FIGHTER  AIRCRAFT  ENGINE 

An  ideal  situation  would  of  course  prevail  if  only  one  type  of  aircraft  could  fulfil  all 
possible  fighter  missions,  i.e.  a  true  multirol  combat  aircraft  could  be  defined  and  built. 
Experience  has  shown  that  this  is  not  practical  because  of  fairly  large  compromises  that 
would  have  to  be  accepted,  making  such  an  aircraft  inferior  to  other  aircraft  specially 
tailored  around  a  certain  role  or  mission.  However,  it  is  possible  to  combine  a  limited 
number  of  different  missions  m  the  design  of  a  single  aircraft.  For  such  an  aircraft 
typical  requirements  on  the  propulsion  unit  could  then  be  as  follows: 

Short  power  transient  times  near  SI.S  if  short  take-off  and  landing  distances 
(thrust  reverser)  are  required 

Maximum  possible  take-off  thrust  in  reheat 

Low  fuel  consumption  during  typical  cruise  and  loiter  missions  at  different 
altitudes,  Mach-Numbers  and  power  settings 


Maximum  possible  thrust  for  aircraft  accelerations,  tight  turns  and  combat 
Short  power  transients  and  safe  and  reliable  engine  response  during  dog  fights 
High  power  offtake  from  one  engine  particularly  in  a  failure  case. 

These  operational  requirements  can  be  translated  into  the  following  engine 
requirements 

sufficient  fan  and  compressor  surge  margins  to  cope  with  fast  power  transients 
in  both  accelerating  and  decelerating  directions 

sufficient  fan  and  compressor  surge  margins  to  cope  with  intake  flow 
distortion  due  to  aircraft  incidence  or  firing  of  weapons 

sufficient  compressor  surge  margins  to  cope  with  shaft  power  offtake 
maximum  dry  thrust 
maximum  afterburner  thrust 

minimum  dry  specific  fuel  consumption  at  cruise  ratings. 

It  can  be  shown  that  these  requirements  usually  only  exist  one  at  a  time,  i.e.  while 
for  instance  maximum  dry  thrust  is  required  there  is  no  need  to  make  provision  for  best 
cruise  specific  fuel  consumption  or  for  good  engine  handling  potential  and  vice  versa. 

ENGINE  TRIMS  TO  COPE  WITH  REQUIREMENTS 

Fig.l  shows  an  example  of  a  military  engine  with  its  control  variables.  The  number  of 
control  variables  also  depends  on  the  design  philosophy  of  the  engine  and  the  components 
respectively  particularly  with  items  like  variable  compressor  stator  blades.  For  this 
investigation  only  those  variables  have  been  included  which  are  necessary  for  troublefree 
operation  of  the  components  within  the  engine.  Not  included  are  the  so  called  variable 
cycle  engines  which  make  use  of  additional  variable  geometry  in  order  to  actively  adjust 
the  thermodynamic  cycle  to  certain  missions.  Should  this  type  of  engine  ever  be  introduced 
it  would  lend  itself  even  more  to  the  benefits  of  Mode  Control.  However,  for  this  paper 
the  example  of  a  military  three-spool  by-pass  engine  equipped  with  an  afterburner  has  been 
chosen.  Its  control  variables,  shown  on  the  lower  half  of  fig.l,  are  as  follows: 

Intermediate  compressor  air  bleed 
High  pressure  compressor  air  bleed 
Engine  fuel  flow 
Afterburner  'uel  flow 
Variable  nozzle  area. 

The  control  of  the  engine  is  such  that  the  air  bleeds  are  closed  over  the  important 
part  of  the  flight  envelope  when  running  steady  state.  In  the  afterburner  off-mode  the 
nozzle  area  is  constant.  With  the  afterburner  operational  the  resulting  fan  running  line 
is  slightly  higher  than  for  dry  operation. 

In  fig. 2  the  optimal  running  lines  for  maximum  afterburner  thrust,  dry  thrust  and 
lowest  cruise  specific  fuel  consumption  are  shown  as  an  example  in  a  simplified  form. 

The  effect  of  intake  pressure  distortion  is  indicated.  Figs. 3  and  4  show  the  effects  of 
flow  distortion,  shaft  power  offtake  and  transients  together  with  the  effects  of  compres¬ 
sor  air  bleeds. 
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MODE  CONTROL  -  A  CONCEPT  TO  SELECT  THE  RELEVANT  ENGINE  TRIM  ONLY  WHEN  REQUIRED 

The  simple  sketches  in  figs. 2  to  4  highlight  already  one  important  fact: 

Any  measures  to  improve  the  engine  handling  limits,  such  as  the  use  of  air  bleeds 
cannot  be  continuously  used  over  important  parts  of  the  flight  envelope  because  of  their 
detrimental  effects  on  steady  state  performance  (thrusts  and  SFCs).  Therefore  with  the 
present  control  system  philosophy  the  datum  core  compressor  running  lines  without  bleed 
have  to  be  positioned  low  enough  to  ensure  surge  free  operation  under  the  most  severe 
combinations  of  aircraft  incidence,  power  offtake  and  engine  transients.  This  compromise 
can  entail  a  fairly  heavy  penalty  on  steady  state  performance  m  terms  of  thrust  and  SFC. 

When  looking  at  the  time  distribution  of  the  various  operational  requirements  the 
following  becomes  obvious 

operational  requirement  approx  time  prevailing 

handling  and  high 

power  offtakes  seconds 

maximum  thrusts  minutes 

lowest  SFCs  hours 

It  can  therefore  be  concluded  that  the  normal  engine  matching  with  its  penalties  on 
steady  state  performance  has  to  be  chosen  such  that  no  operational  problems  are  to  be 
expected  when  severe  handling  requirements  prevail  just  for  a  few  seconds.  Mocte  Control 
can  help  to  either  eliminate,  or  at  least  minimize,  these  performance  penalties  by  mat¬ 
ching  the  engine  closer  to  the  optimum  steady  state  performance.  This  usually  means  com¬ 
pressor  running  lines  closer  to  the  respective  surge  lines  and  use  of  available  engine 
trims  to  cope  with  the  special  short  duration  handling  requirements. 

Fig. 5  shows  a  simple  block  diagram  of  the  general  philosophy  of  Mode  Control.  The 
principle  is  as  follows: 

Two  sources  of  information  are  available  in  order  to  determine  the  actual  requirement 
on  the  engine  at  any  given  point  in  time,  i.e. 

(a)  aircraft  computer,  whose  data  is  used  to  compute  rlight  condition 
and  type  and  magnitude  of  flow  distortion 

(b!  pilot's  throttle  from  which  adequate  information  can  be  derived  for 

determination  of  what  the  pilot  expects  from  the  engine  at  any  moment 
of  time.  Fig. 6  interpretes  the  information  to  be  deduced  from  the 
throttle  signal. 

No*  shown  in  fig. 5  is  a  power  offtake  signal  which  in  certain  cases  of  relatively  high 
offtake  requirements  could  be  useful.  A  fairly  simple,  not  necessarily  very  accurate, 
torquemeter  on  the  drive  shaft  would  be  sufficient.  The  information  from  the  two  (or  three) 
sources  is  then  processed  in  a  small  computer  programme  employing  a  matrix  approach.  It 
determines  the  trim(s)  to  be  selected  in  order  to  cope  with  the  prevailing  situation  in  an 
optimal  way. 

In  order  to  implement  Mode  Control  successfully  it  is  important  to  make  sure  that  the 
response  rates  of  the  engine  variables  or  trims  are  compatible  with  the  requirements,  i.e. 
the  respective  rates  at  which  a  certain  problem  can  develop. 

It  should  be  pointed  out  that  because  of  the  type  of  computing  required  a  digital 
trol  system  is  more  suitable  for  this  task  than  an  analogue  one. 


con- 


TW 


13-4 

DEMONSTRATION  PROGRAMME 

la  1978  a  demonstrator  programme  sponsored  by  the  German  government  was  launched. 

This  programme  includes  the  construction  of  two  flightworthy  digital  engine  controls 
by  1980.  Following  checking  out  on  a  simulator  and  an  engine  m  a  high  altitude  test 
facility  it  is  planned  to  flight  test  the  complete  control  system,  including  Mode  Control 
in  an  aircraft. 


Variable  fan  Compressor  Vrnable  Engine  fuel  Afterburner  Variable  Thrust 
Stators  bleed  (s)  compressor  flow  cold/hot  stream  nozzle  reverser 


Aircraft  computer 


Pilot's  throttle 


Compute  flight  condi¬ 
tion  and  type  and  mag¬ 
nitude  of  flow  distor  - 
tion 


Determine 
optimum  trims 


Derive  "Mode  of 

4> 

Control" 

" 

*  . 

HP6  bleed 

HPTbi^  Drv  1En?'ne 

Tbi^d  Contro1 


Dry  Engine  Fuel 
System 


Reheat  Fuel 
System 


Fia.5  Flow  chart  of  Mode  Control 


Engine  performance  parameters  (generalized) 


N? 

Mode  of  Operation 

Source  of  Signal  for 

Selection  of  the  Mode 

Essential 

Requirements 

1 

Idle 

a=  aldle 

lowest  thrust 

2 

Cruise 

G.  max  dry  >&idle 

lowest  installed  SFC 

B 

Max  Dry 

0.  -  QL  mQX  dry 

highest  max  dry  thrust 

4 

Max  Reheat 

®  ^  max  RH 

highest  max  RH  thrust 

5 

Dry  Acceleration 

^ idle  <  CX  <  Cl  mQX  dry  Cind 

(a  >  a  or 
dN  H  /  dt  >  b) 

sufficient  surge 
margins 

1 

6 

Dry  Deceleration 

(^idle<^,<  ^max  dry  Cind 

(a  <  a  or 
d NH / dt  <  c) 

sufficient  surge 
margins 

7 

Reheat  Acceleration 

^mmRH<<^  <  ^max  RH 

(d  >  a  or 

d A 7/  dt  >  d) 

sufficient  surge 
margins 
correct  fuelling 

8 

Reheat  Deceleration 

<  ci^qxri-i  and 
(d  <  a  or 

d A 7 / dt  <  e) 

sufficient  surge 
margins 

correct  fuelling 

9 

Slam  from  Dry  into 
Reheat 

^  >  ^mm  PH  Qnd 

(  A7mQX  dry  <  Ay<  A7fIlin  OT 

dA?  /dt  >  d) 

sufficient  surge 
margins 

correct  fuelling 

Fig. 6  Identification  criteria  for  mode  of  operation  and 

requirements  on  engine 
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DISCUSSION 


R. Smyth,  Ge 

Idle  Thrust  Comments  to  question  of  speaker  concerning  idle  thrust  requirements  of  civil  aircraft. 

The  present  generation  of  high  bypass  ratio  engines  also  demands  lowest  possible  idle  thrust  for  comfortable  taxying 
and  low  fuel  consumption  in  taxi  operation.  However,  at  the  same  time  acceleration  requirements  for  time  from  idle 
to  max  power  have  to  be  met  Generally  the  airframe  manufacturer  demands  also  here  the  lowest  possible  idle  thrust. 

Author’s  Reply 

Yes,  this  is  very  true.  To  keep  the  acceleration  time  down  it  is  important  to  fix  the  idle  speed  at  not  too  low  a  level. 


D.K. Andrews,  UK 

Do  you  envisage  that  a  mode  computation  and  trim  control  computer  will  be  integrated  with  each  engine  control  - 
or  will  a  separate  airframe  located  computer  be  used  to  trim  all  engines9 

Author’s  Reply 

I  propose  to  integrate  Mode  Control  into  the  individual  engine  control  box  mainly  on  the  basis  that  each  engine  has 
its  own  throttle. 


R.D.Matulka,  US 

Have  you  considered  dividing  the  idle  mode  into  two  input  functions.  (1)  minimum  thrust  and  (2)  minimum  fuel 
flow? 

Author’s  Reply 

This  is  not  included  in  our  present  specification  of  Mode  Control.  However,  if  the  pilot  positions  the  throttle  just 
a  small  amount  off  the  idle  minimum  thrust  position,  the  engine  is  automatically  trimmed  to  optimum  SFC. 


G.E.Davies,  UK 

1  am  surprised  you  have  response  problems  with  bleed  valves.  Is  this  because  you  are  using  switched  type  bleed 
valves  which  select  full  bleed  flow  in  a  single  operation?  If  you  had  modulating  bleed  valves  you  would  be  able  to 
select  the  optimum  level  of  bleed  flow  for  any  particular  situation  and  also  probably  obtain  better  response  as  well. 

Author’s  Reply 

Yes,  a  valve  the  flow  of  which  can  be  modulated  would  be  preferable  to  a  two  position  valve.  I  also  believe  that  the 
response  problem  can  be  overcome,  but  it  is  an  area  that  requires  attention. 


J. McNamara,  UK 

System  Configuration.  Is  the  thrust  demand  (PLA)  input  better  organised  if  taken  through  the  aircraft  computer 
system  in  order  to  compute  for  high  'G’-tums,  intake  distortion  parameters? 

Author’s  Reply 

If  during  ‘G’-turns  the  flow  patterns  into  the  two  engines  should  be  substantially  different,  yes,  additional  infor¬ 
mation  fron.  the  a/c  computer  may  be  required. 


M .Perks,  UK 

Thrust  Response  What  background  work  has  been  done  to  confirm  that  any  transient  loss  of  thrust  following  mode 
switchmg  during  an  acceleration  is  acceptable  in  terms  of  aircraft  handling? 

Author’s  Reply 

In  general  there  should  not  be  a  problem  if  during  a  transient  lasting  a  few  seconds  the  thrust  is  reduced  by  say  4 
to  Ti  However,  in  certain  special  cases  the  possible  implications  have  to  be  investigated  carefully. 
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SUMMARY 

Some  form  of  redundancy  is  almost  always  required  in  full  authority  electronic 
engine  controls.  The  paper  surveys  the  available  methods,  and  the  reasons  for  their 
selection  in  particular  applications,  with  particular  reference  to  the  effects  of  the 
electro-hydromechanical  interface. 

The  bulk  of  the  paper  is  devoted  to  discussion  of  various  'dual'  redundant 
arrangements  and  describes  practical  experience  with  some  of  them  -  particularly  the 
unexpected  difficulties. 

The  paper  considers  system  safety  and  the  variety  of  failure  survival  strategies 
which  can  be  employed.  In  general,  ease  of  analysis  is  accompanied  by  simple  failure 
survival  strategies.  More  complex  strategies  may  result  in  higher  system  availabilities 
and  there  is  therefore  a  trade-off  to  conduct  between  non-recurring  design  cost  and 
system  availability  in  service. 

Military  requirements  and  microprocessors  permit  more  flexible  system  architectures 
than  before.  The  impact  of  these  possibilities  is  discussed  and  the  direction  of  future 
developments  is  indicated. 


INTRODUCTION 

All  the  authors  have  long  been  active  in  the  field  of  engine  control.  The  joint 
activities  of  Dowty  Fuel  Systems  and  Smiths  Industries  in  digital  engine  control  go 
back  for  many  years  before  their  formal  association  as  Dowty  and  Smiths  Industries 
Controls  Limited  and  the  work  described  in  this  paper  is  in  some  sense  a  history  of 
these  joint  activities  up  to  the  present  day. 

The  objective  of  the  paper  is  not  however,  historical  but  is  to  present  some  of  the 
reasons  behind  current  system  thinking  using  past  experience  by  way  of  illustration. 


Technical  Requirements 


The  engine  control  system  designer  often  finds  himself  in  an  unusual  position 
compared  with  the  designers  of  many  other  aircraft  systems.  On  the  one  hand  only  a 
relatively  small  budget  in  terms  of  size,  weight,  power  consumotion  and  system  cost  is 
available  compared  with  the  budget  associated  with,  for  example  automatic  flight  control, 
and  yet  on  the  other  hand  the  safety  implication  of  loss  of  engine  power  and  even  more 
so  of  secondary  airframe  damage  due  to  engine  power  runaway,  approach  the  safety 
implication  of  loss  of  flight  control.  There  is,  therefore,  a  continuous  pressure  on 
the  engine  control  system  designer  to  arrive  at  system  compromises  between  performance 
and  safety. 


There  were  also  differences  m  the  evolution  of  the  two  types  of  control.  The  move 
from  simple  "rod  and  cable"  operation  of  flight  control  surfaces  to  automatic  flight 
control  was  accompanied  by  a  significant  level  of  redundancy  in  the  electro-mechanical 
systems.  Engine  control,  on  the  other  hand,  moved  rapidly  to  the  sophisticated  simplex 
(i.e.  non-redundant)  but  highly  reliable  hydromechanical  systems  to  be  found  in  the 
majority  of  present  day  aircraft. 


All  such  systems  rely,  for  continuity  of  control,  on  the  high  integrity  of  well 
designed  simplex  parts.  Many  of  the  systems  also  rely  on  these  simplex  parts  in  order 
to  avoid  overspeed.  This  extensive  reliance  on  single  components  is,  m  part,  made 
possible  oy  the  grading  of  "authority",  i.e.  the  degree  to  which  the  fuel  flow  can  be 
affected  by  the  various  parts  of  the  system. 
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Some  engines  used  redundancy  xn  their  overspeed  limiters  (Figure  1)  which,  in  many 
U.K.  designs,  used  separate  valves  for  flow  control  and  limiting.  Many  of  the  limiters, 
particularly  temperature  limiters  were  electronic.  Development  of  engine  technology  led 
to  ever  increasing  demands  on  the  control  system  both  in  terras  of  accuracy  and  complexity 
and  the  designers  of  the  60' s  started  to  include  quite  complex  electronic  'trimming' 
controls  and,  building  on  their  existing  experience,  tended  to  accept  simplex  configura¬ 
tions  with  limited  electronic  authority  over  the  engine  working  point. 

These  analogue  electronic  trimming  controls  are  used  on  many  current  aero-engines 
e.g.  R8.211,  TF.41,  TF,30,  Spey,  Pegasus,  etc. 

Many  trimming  systems  are  redundant  in  the  sense  that  adequate  control  can  be 
retained  after  failures  in  the  trimming  function.  This  makes  it  possible  to  accept 
higher  failure  rates  for  trimming  than  could  be  tolerated  for  primary  control  functions. 

The  first  digital  systems  to  enter  service  exploited  this  feature  by  applying  sophisticated 
trimming  functions  to  a  fairly  conventional  hydromechanical  control  system  in  a  control 
configuration  called  "Supervisory"  (Figure  2) . 

The  arrangement  illustrates  very  well  the  conflict  between  economics  (or  performance)’ 
and  safety  which,  as  mentioned  earlier,  is  a  dominant  feature  of  the  design  of  electronic 
controls  for  engines.  The  benefit  of  the  supervisory  system  is  that  it  improves 
performance  when  it  is  operating  but  its  failure  cannot  hazard  the  aircraft.  The  other 
side  of  the  coin  is  the  need  to  carry  a  complete  hydromechanical  system  as  well  as  the 
electronics  and  tne  fact  that  the  very  authority  limitation  which  makes  it  safe  can  also 
prevent  it  achieving  the  full  performance  benefits  which  are  possible.  The  full  authority 
systems  discussed  in  this  paper  seek  to  resolve  the  safety  issue  without  imposing  limits 
on  performance.  At  the  same  time,  they  allow  the  hydromechanical  content  of  the  system 
to  be  reduced  and  simplified. 

While  engine  controls  had  been  developing  the  electronic  trimmer  theme,  the  flight 
control  designers  developed  electronic  and  electro-mechanical  redundancy  full  authority 
systems  for  such  applications  as  auto-landing  and  fly-by-wire.  From  this  flight  control 
experience  came  a  new  world  of  semi-statistical  design  analysis  techniques  which  were 
required  to  build  up  confidence  in  the  systems  prior  to  actual  flight  experience.  Indeed 
it  soon  became  obvious  that  flight  experience  would  never  really  measure  the  demanded 
safety  levels  directly,  the  best  that  could  be  hoped  for  being  the  build  up  of  confidence 
m  some  of  the  assumptions  used  in  the  safety  analysis.  Hence,  wnen  the  time  came  to 
introduce  full  authority  electronic  engine  controls,  the  safety  and  reliability  analysis 
was  usually  done  from  the  background  of  this  flight  control  experience,  rather  than  from 
the  background  of  the  traditional  hydromechanical  engine  control. 

As  illustrated  by  the  supervisory  system  above,  the  electronic  engine  control 
designer,  whether  working  in  the  analogue  or  the  digital  field  was  therefore  under  two 
pressures.  Firstly  to  continue  designing  with  the  basic  economy  of  the  traditional 
hydromechanical  control  and  secondly  to  meet  ever  increasing  demands  of  statistically 
provable  safety. 

The  design  team  with  which  the  authors  have  been  associated  over  this  period,  has 
been  trying  to  find  acceptable  compromise  solutions  to  this  dual  requirement.  This 
search  has  led  at  intervals  to  our  being  described  as  pedants,  starry  eyed  idealists 
and  downright  specification  dodgers.' I 

The  first  system  design 

At  the  beginning  we  felt  that  there  would  be  no  real  possibility  of  the  industry 
accepting  engine  control  system  designs  which  relied  on  more  than  two  complete  paths  or 
'LANES'.  The  first  such  solution  proposed  was  for  the  PS50  engine  and  consisted  of  two 
sets  of  input  transducers,  two  digital  computers  and  a  simplex  actuator  of  the  proportional 
solenoid  type  for  the  main  engine  control  and  additional  permanent  magnet  stepping  motor 
actuators  for  the  various  afterburner  fuel  flows  anc.  nozzle  control.  (Figure  3). 

The  two  computers  exchanged  transducer  data  via  optical  unidirectional  data  links 
and  proceeded  to  use  average  data  for  control  unless  the  data  from  the  two  LANES  was 
outside  a  predetermined  tolerance.  The  outputs  of  the  two  computers  were  also  exchanged 
and  compared  by  both.  If  both  agreed  that  the  comparison  was  good,  one  of  the  two  lanes 
drove  the  actuator  controlling  the  engine.  No  provision  was  made  for  driving  the 
actuator  from  the  other  lane,  or  for  determining  which  of  the  two  lanes  was  faulty.  It 
followed  that  if  either  lane  detected  a  failure,  the  actuator  was  disconnected  and  the 
overall  engine  system  degraded  into  (a)  nydromechamcal  back-up  control  of  the  mam 
engine  (b)  frozen  reheat  flows  which  could  be  manually  shut  down. 

This  system  was  successfully  operated  on  a  test  bed  and  shown  co  have  all  the 
necessary  safety  features  except  the  ability  to  continue  operation  after  most  first 
failures.  Failure  survival  was  limited  to  deleting  functions  (e.g,  temperature  limiting) 
associated  with  single  sensors  anc.  which  were  traditionally  "trimming"  functions.  A 
second  set  of  equipment  was  therefore  built  which  was  aimed  at  adding  ability  to  continue 
operating  with  full  performance  after  any  first  failure. 
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The  Improved  System  Design 

If  any  system  is  to  survive  a  first  failure  at  an  acceptable  rate  it  must  satisfy 
three  major  requirements :- 

(a)  'Single  thread'  elements  must  be  few  and  highly  reliable. 

{ b )'  The  reconfiguration  mechanism  must  have  a  comparable  success  rate. 

(c)  The  failed  element  must  be  reliably  excluded  from  the  reconfigured  system. 

Examination  of  the  first  system  showed  that  (a)  could  be  met  if  the  simplex  main 
engine  and  nozzle  control  actuators  were  replaced  by  dual  drive  units.  In  this  system 
as  in  all  DSIC  systems  isochronous  governing  was  achieved  by  using  the  stepping  motor  as 
an  output  integrator.  This  allows  the  digital  computer  to  recover  rapidly  from  any 
power  failure  causing  loss  of  temporary  stored  control  data,  by  minimising  the  time 
dependence  of  the  system  on  such  data.  It  was  also  required  that  the  relationship 
between  actuator  position  and  fuel  flow  be  stable,  so  that  in  the  event  of  digital 
control  shut-down,  the  fuel  flow  remains  constant  until  recovery  action  is  taken  by  the 
back-up  system.  In  the  case  of  afterburner  control,  a  known  and  accurate  relationship 
between  actuator  position  and  fuel  flow  is  also  required  in  order  to  avoid  the  need  for 
some  form  of  fuel  flowmeter  feedback  to  the  electronic  controller. 

Meeting  the  last  requirement  proved  to  be  much  easier  on  paper  than  expected  in  a 
two  lane  system.  Briefly,  the  system  operated  with  both  lanes  active  when  both  lanes 
were  failure  free.  Inputs  were  exchanged  as  in  the  case  of  the  first  system  and  the 
lanes  exchanged  output  data  as  before.  If  both  agreed,  both  motors  were  driven  and  the 
mechanical  outputs  consolidated  by  summing  in  a  differential  gearbox  (Figure  4  ).  If 
the  two  lanes  disagreed,  the  idler  cage  of  the  differential  rotated  and  operated  a 
mechanical  switch  which  disconnected  the  two  motors,  thus  freezing  the  system.  Both 
lanes  then  entered  a  self-check  process  and  if  one  and  only  one  self-tested  as  faulty 
the  other  was  allowed  to  continue  control.  This  process  can  only  result  in  a  wrong 
reconnection  if  the  good  lane  self-tests  as  'bad1  and  the  bad  lane  simultaneously  self- 
tests  as  'good'.  The  probability  of  wrong  connection  is  very  low  provided  that  the 
decision  based  on  the  self-tests  can  be  executed  with  acceptable  error.  In  the  system 
which  was  tested,  the  decision  mechanism  itself  was  duplicated  and  dual  failure  would  be 
necessary  to  allow  the  connection  of  the  wrong  lane.  A  flight  standard  system  was 
fully  evaluated  on  an  Adour  engine  (Figure  5-6).  What  proved  to  be  far  more  difficult 
was  to  prove,  partly  by  analysis,  requirement  (b)  -  that  the  reconfiguration  itself  would 
be  successful  as  often  as  was  specified. 

This  improved  system  was  built  and  tested.  Full  fault  recovery  tests,  including 
tests  in  which  faults  were  introduced  in  the  middle  of  full  speed  slam  accelerations 
and  in  the  middle  of  fast  reheat  aquisitions  and  throttle  movements  showed  the  ability 
of  the  system  to  react  correctly  to  induced  faults.  Difficulties  were  experienced 
however  after  an  unexpected  failure  of  the  HP  pump  followed  by  intermittent  stalling  of 
both  halves  of  the  dual  motor  actuators.  This  effect,  which  is  discussed  later,  served 
to  illustrate  the  importance  of  ensuring  that  the  external  environment  of  any  redundant 
system  is  unlikely  to  cause  common  mode  failures  and  that  late  consolidation  is  desirable. 

At  no  time  during  the  system  tests  and  trials,  which  covered  fifteen  hundred  hours 
of  rig  and  engine  time,  was  there  any  indication  that  the  system  organisation  required 
revision  in  principle. 

During  these  tests  use  was  made  of  early  versions  of  modular  software  design 
procedures  which  include  comparison  of  test  results  obtained  on  two  dissimilar  processors 
and  coded  independently.  Improvements  were  also  made  to  the  computer  an  i  software 
organisation  and  in  particular  the  need  for  close  synchronisation  between  the  two  lanes 
of  the  system  was  removed. 

Other  System  Configurations 

The  supervisory  control  and  the  fully  duplicated  system  design  represent  the  two 
poles  of  system  design.  Between  them  lie  a  range  of  full  authority  systems  using 
limited  replication  and  technology  which  may  be  dissimilar. 

Pegasus  Engine  Control 

The  existing  system  on  the  Pegasus  engine  uses  an  electronic  limiter  and  also  a 
redundant  and  much  simplified  hydromechanical  flow  control  for  use  after  a  failure  m 
the  main  hydromechanical  control  (Figure  7) .  Full  authority  digital  control  of  the 
Pegasus  engine  has  been  demonstrated  by  Dowty  end  Smiths  Industries  Controls  Limited, 
together  with  two  different  forms  of  reversionary  control.  One  form  was  hydromechanical; 
the  other  was  electronic.  Both  provided  automatic  changeover  after  a  failure  m  the 
full  authority  digital  control.  The  existing  system  used  manual  changeover  and  involves 
a  power  excursion  which  both  the  newer  systems  avoid. 

The  reversionary  systems  are  much  simpler  than  either  the  existing  hydromechanical 
main  control  or  the  full  authority  digital  control.  Their  prime  purpose  is  to  allow  the 
aircraft  to  be  landed  safely  after  a  failure  in  the  main  control.  The  automatic 
changeover  allows  failure  to  be  survived  while  the  aircraft  is  hovering  -  a  capability 
which  the  existing  system  does  not  possess. 


14-4 


The  design  of  the  reversionary  controls  is  aimed  at  meeting  the  minimum  safe 
handling  capability  with  the  least  possible  hardware.  In  contrast  to  the  Pegasus, 
in  the  exploratory  Adour  system  mentioned  earlier,  the  target  was  to  retain  full 
specification  performance  after  a  failure. 

Different  design  trade-offs  can  be  made.  The  reversionary  systems  which  have  been 
demonstrated  on  Pegasus  are  minimum  hardware  systems.  They  simply  provide  safety  and 
a  "get-you-home"  capability.  A  second  design  objective  would  be  some  level  of  enhanced 
reversionary  capability  which  provides  a  better  match  between  complexity  and  performance. 

Figures  8  and  9  show  the  levels  of  performance  achieved  during  test-bed  development. 
Figure  8  shows  transient-free  reversion  to  the  emergency  hydromechanical  system.  Figure  9 
shows  a  reversion  to  the  electronic  reversionary  system  during  an  engine  acceleration. 

The  only  inputs  to  the  reversionary  system  were  power  demand  and  H.P.  spool  speed. 


Helicopter  Engine  Control 


The  electronic  arrangement  demonstrated  for  Pegasus  applies  one  or  other  of  the 
electronic  control  outputs  to  the  same  flow  control  valve  using  a  single  drive  motor. 
The  arrangement  used  for  the  Adour  system  combined  two  motor  outputs  via  a  mechanical 
consolidation  to  drive  a  single  valve.  The  authors  are  also  working  on  a  digital  full 
authority  system  for  helicopter  engines  in  which  the  point  of  consolidation  is  in  the 
valve  assembly  itself. 


In  other  respects  the  system  structure  is  like  that  described  for  Pegasus  using 
electronic  reversion.  In  this  application  the  engine  is  planned  to  be  used  in  a  twin- 
engined  helicopter  with  the  two  power  turbines  mechanically  coupled  to  a  single  rotor. 
The  arrangement  Is  one  which,  after  a  first  failure,  allows  power  modulation  to  be 
provided  by  one  or  other  of  the  engines  while,  over  large  parts  of  the  flight  envelope, 
the  other  is  held  on  a  fixed  power  setting.  The  infrequent  need  fox  power  changes  on 
the  second  engine  make  it  possible  to  use  a  very  simple  reversionary  system  and  yet,  in 
terms  of  the  vehicle  itself,  retain  unimpaired  performance. 


The  full  system  arrangement  for  the  aircraft  is  shown  in  Figure  10.  The  hydro¬ 
mechanical  control  section  of  both  the  Pegasus  and  the  helicopter  control  system  is 
greatly  simplified  compared  to  a  conventional  hydromechanical  control.  Figure  11 
shows  the  valve  arrangement  for  the  helicopter  control  illustrating  the  method  of 
consolidation  of  electrical  inputs  at  the  valve  itself,  (see  later). 


So  far  we  have  described  four  full  authority  electronic  systems.  One,  the  PS50 
system,  was  simply  a  step  ir>  development  but  it  will  be  clear  from  the  discussion  of 
the  other  three  that  there  is  no  single  general  purpose  system  design  and  that  the 
vehicle  in  which  the  engine  is  used  plays  a  major  role  in  influencing  the  trade-offs 
and  the  safety  features  of  any  given  design. 


We  have  referred  earlier  to  output  consolidations  and  to  actuation  arrangements 
in  redundant  systems.  We  now  turn  to  these  topics  in  more  detail. 


Electro-Hydromechanical  Interfacing 


The  electro-hydromechanical  interface  unit  has  to  provide  the  means  by  which  the 
electronic  controller  influences  either  the  amount  of  fuel  metered  to  the  engine  or  a 
variable  geometry  feature  such  as  inlet  guide  vanes  or  exit  nozzle  area  control. 


For  fuel  metering  the  interface  unit  generally  comprises  an  electric  actuator  and 
a  fuel  control  valve;  dual  redundancy  can  be  used  for  both  of  these  sub-units,  but  it 
is  unusual  to  justify  the  use  of  more  than  one  fuel  control  valve  per  discrete  function. 

There  are  numerous  ways  of  forming  the  consolidation  of  the  two  electronic  control 
channels.  Each  of  the  systems  described  earlier  used  a  different  form  of  consolidation 
and  each  will  be  discussed  in  some  detail  after  a  few  scene  -  setting  observations. 


The  most  simple  fuel  control  interface  unit  would  comprise  a  motor  and  a  fuel  tap. 
The  state  of  the  art  has  not  yet  reached  this  goal  because  of  practical  problems  m 
signal  transducing  and  obtaining  suitable  control  loops  with  acceptable  failure  modes. 


For  some  simple  applications,  particularly  for  dry  engines,  it  is  still  preferable 
to  retain  pressure-sensing  bellows,  as  used  in  conventional  hydromechanical  controls, 
within  the  interface  unit  rather  than  rely  on  electrical  pressure  transducers  to  provide 
duplicated  signals  for  inclusion  in  the  electronic  computations  for  fuel  demand.  Thus 
for  a  helicopter  application  an  interface  unit  using  an  electrical  demand  of  Fe/Pp 
(engine  fuel  flow  -  total  intake  pressure)  via  a  hydromechanical  sub-unit  incorporating 
a  bellows  can  be  shown  to  have  practical  advantages  over  a  unit  which  meters  Fe  only, 


with  the  P,  term  being  sensed  and  computed  externally  to  the  interface.  Similarly 
for  a  VTOL  application  like  the  Pegasus,  there  is  advantage  in  using  Fe/Pj  (engine 
fuel  flow  -  compressor  delivery  pressure) .  In  these  units  the  electric  actuator  is 
set  by  the  electronic  controller  to  select  a  demanded  value  of  Fe/Pi  or  Fe/Pj  and 
this  is  provided  by  the  hydromechanical  elements  of  the  unit. 

In  the  PS50  and  Adour  engine  runs  mentioned  earlier,  we  used  electrical  pressure 
transducers  with  simplified  hydromechanical  valves  and  we  believe  this  is  still 
acceptable  for  afterburner  fuel  scheduling  controls  where  the  reliability  requirements 
are  less  stringent  than  for  main  engine  control. 

For  a  helicopter  application  the  Mach.  No.  and  altitude  envelope  is  relatively 
limited  and  satisfactory  control  can  be  achieved  using  the  Fe/Pj  type  of  interface, 
whereas  for  the  Pegasus  the  operational  envelope  is  wider  in  scope  and  a  Fe/P3  interface 
is  preferred.  There  is  a  distinct  advantage  of  this  type  of  control  for  Pegasus 
because  an  incipient  engine  surge,  perhaps  caused  by  reingestion  of  hot  gas,  at  a 
selected  value  of  Fe/Pj  results  in  a  rapid  fall  in  compressor  pressure  and  this  will 
cause  a  corresponding  reduction  in  the  engine  fuel  flow  and  thus  minimise  the  risk  of 
damage  to  the  engine.  This  action  would  still  occur  under  electrical  control  with  a 
separate  electrical  transducer  but  the  maximum  rate  of  fuel  reduction  would  be  limited 
by  the  actuator  response. 

The  case  for  using  electrical  pressure  transducers  becomes  stronger  for  the  complex 
military  engine  where  there  may  be  a  requirement  for  up  to  four  metered  flow  streams  to 
provide  for  the  main  engine  and  multi-manifold  afterburner  system.  The  metering 
schedules  for  all  the  flow  streams  may  require  a  common  pressure  term  which  can  be 
supplied  from  a  pressure  transducer,  duplicated  for  reliability,  and  computed  in  the 
electronic  controllers.  This  gives  a  considerable  saving  in  weight  and  cost  of  sensing 
elements. 

General  Features  and  Considerations  for  Interface  Design 

The  electrical  sub-unit  of  the  interface,  referred  to  as  the  actuator,  comprises 
a  motor  or  a  combination  of  motors  and  these  may  be  of  the  following  types :- 

(a)  d.c.  stepper  motor 

(b)  a.c.  induction  motor 

(c)  torque  motor 

(d)  solenoid 

The  choice  of  the  type  involves  the  following  considerations : - 
r  its  failure  mode,  particularly  when  electrical  power  is  removed 

ii  complexity  of  driver  electronics 

iii  failure  mode  of  driver  electronics 

iv  power  consumption  and  related  heat  dissipation  in  power  supplies  and  driver  circuits. 
This  affects  the  size  of  the  electronic  control  box  and  its  cooling  requirements. 

v  range  of  operation  from  minimum  to  maximum  flow  demand  in  terms  of  angular  or 
linear  output  movement  representing  fuel  demanded. 

vi  speed  or  response  requirements  to  satisfy  overall  accelerations  and  also  transients 
for  control  loop  stability. 

vii  resolution  required  for  accuracy  of  setting  acceleration  and  steady-state  flow 
schedules . 

viii  minimum  output  torque,  or  force,  required  to  operate  fuel  valve. 

Additionally  the  actuator  may  include  position  transducers  and  some  mechanical 
devices  such  as  gearboxes  or  differentials,  and  inevitably,  it  has  to  be  decided  whether 
the  actuator  is  to  be  sealed  against  fuel  or  be  fuel-immersed.  Seals  can  greatly  increase 
the  output  force  or  torque  required  from  the  actuator  assembly  and  it  is  important  to 
allow  an  adequate  output  to  overcome  additional  friction  and  reactive  forces  in  the 
hydromechanical  mechanism  of  the  interface.  Prediction  of  friction  due  to  wear  and 
varying  lubricating  conditions  is  difficult,  yet  an  'overkill'  in  output  can  lead  to 
excessive  power  consumption,  heat  dissipation,  size  and  weight.  If  the  unit  is  to  run 
fuel- immersed,  compatibility  with  fuel  and  fuel-borne  contaminant  has  tc  be  taken  into 
account. 

The  hydromechamcal  sub-unit  and  actuator  have  to  be  designed  as  a  whole  to  give 
the  optimum  performance,  minimum  size  and  cost  for  the  complete  interface  unit.. 
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Design  disciplines  developed  for  conventional  hydromechanical  controls  are 
applicable  but  special  attention  is  necessary  to  provide  minimum  reaction  forces  from 
the  hydromechanics  onto  the  actuator  for  the  reasons  given. 

Particular  preferences 

In  the  three  types  of  interface  described  in  this  paper  the  actuators  run  fuel- 
immersed  and  the  stepper  motor  has  been  the  preferred  type  of  motor  because :- 

(a)  it  uses  a  'pulsed'  signal  input  which  is  compatible  with  the  output  of  digital 
electronic  controllers. 

(b)  it  can  be  used  for  control  without  reliance  on  a  position  or  velocity  feedback. 

This  is  particularly  relevant  to  failure  modes  where  the  requirement  is  to  avoid 
engine  upward  speed  runaway. 

(c)  failures  in  drive  circuits  do  not  give  a  runaway  situation  -  the  stepper  motor 
reacts  by  running  slower  or,  more  frequently,  stopping. 

Generally  a  'fail  frozen'  or  'fail  fixed'  action  is  a  feature  in  digital  electronic 
control  specifications  at  the  present  state  of  evolution,  but  there  are  cases  when 
failure  to  a  particular  state  other  than  'frozen'  is  required  during  certain  engine 
operating  conditions.  For  an  Inlet  Guide  Vane  Control  a  fail-high  requirement  would 
favour  the  use  of  a  torque  motor  which  gives  such  desirable  features  as  low-weight, 
low  cost,  high  speed,  and  low  power  consumption. 

Redundancy  Considerations 

As  we  have  seen  already,  when  two  electronic  control  channels  are  used  to  control 
one  function  whether  it  be  a  fuel  metering  control  or  a  variable  geometry  feature  of 
the  engine,  the  choice  of  degree  of  redundancy  and  the  point  of  consolidation  are 
influenced  by  the  engine  application  and  the  reliability  requirements  appropriate  to 
the  function  of  the  control  channel. 

In  a  multi-engine  helicopter  the  reliability  requirements  permit  us  to  use  a 
dual-dissimilar,  redundant  system  in  which  a  main  electronic  control  drives  a  stepper 
motor  which  operates  the  fuel  metering  valve  in  a  full  control  mode,  while,  after  a 
failure  of  the  main  control,  an  electronic  reversionary  control  drives  a  similar  but 
quite  separate  stepper  motor.  The  latter  motor  operates  a  separate  element  of  the 
fuel  metering  valve  to  give  the  same  overall  metering  effect  as  the  main  channel  stepper 
motor.  The  latter  motor  operates  a  separate  element  of  the  fuel  metering  valve  to  give 
the  same  overall  metering  effect  as  the  main  channel  stepper  motor.  Thus  the  interface 
uses  two  stepper  motors  and  the  consolidation  point  of  the  two  electronic  controls  is 
effectively  in  the  controlled  orifice  of  the  hydromechanical  part  of  the  fuel  control 
valve.  The  form  of  the  consolidation  (described  later) ,  the  low  friction  of  the  valve 
and  the  use  of  fuel-immersed  motors  all  reduce  the  probability  of  common-mode  failure 
effects  of  the  type  mentioned  earlier. 

For  a  single-engine  VTOL  application  such  as  the  Harrier,  where  a  completely 
separate  hydromechanical  manual  fuel  control  is  specified,  two  notable  redundancy 
options  are  available  for  a  digital  electronic  control  system:- 

(a)  a  single  main  electronic  control  channel  with  automatic  reversion  to  the  manual 
fuel  control,  i.e.  a  hydromechanical  redundant  control 

(b)  a  dual  electronic  control  using  duplicate  drive  to  the  main  fuel  control  backed 
in  turn  by  the  existing  hydromechanical  manual  control. 

The  presence  of  the  manual  fuel  control  permits  the  interface  unit  defect  rate  to 
be  improved  by  using  only  one  motor.  The  consolidation  point  in  the  dual  electronic 
channel  option  \b ) ,  can  be  upstream  of  the  electro-hydromechanical  interface. 

For  a  complex  military  engine  application  involving  main  engine  and  afterburner 
control  the  reliability  requirements  necessitate  the  use  of  dual  motor  actuators  for 
the  main  engine  fuel  control  and  the  exit  nozzle  area  control  but  not  for  the  afterburner 
fuel  metering  controls.  For  the  system  evaluation  on  the  Adour  engine  we  built  dual¬ 
motor  actuators  for  the  main  engine  and  exit  nozzle  controls.  In  these  actuators  the 
consolidation  of  the  control  channels  was  in  the  actuator  part  of  the  interface.  For 
the  afterburner  fuel  metering  controls  using  single  motor  actuators  the  consolidation 
point  was  in  the  electronic  channels. 

Description  of  Interface  Examples 

In  this  section  of  our  paper  we  describe,  in  detail,  some  types  of  interface 
actuators  which  we  have  already  mentioned. 

Dual  Motor  Actuatoi 


Firstly,  the  dual  actuator  which  we  built  and  ran  on  the  main  fuel  metering  control 
of  an  Adour  engine  and  also  for  the  nozzle  exit  area  controller  using  a  full  authority 
digital  electronic  control  system,  is  shown  in  section  in  Fig.  12.  The  actuator  provided 
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a  linear  axial  output  which  we  used  to  load  an  input  selection  spring  of  the  main 
engine  flow  scheduling  unit  and  a  similar  actuator  was  used  to  drive  a  control  spool 
valve  for  the  nozzle  control. 

Two  independently  driven  stepper  motors  of  identical  basic  design  were  arranged 
so  that  the  individual  rotations  of  each  motor  armature  were  added  together  in  a  nut 
and  screw  assembly  to  give  the  actuator  axial  output  displacement.  Motor  B  drove  the 
screw  and  motor  A,  the  nut.  The  nut  was  restrained  from  axial  travel  under  normal 
working  loads  and  rotated  within  a  ball-race  housed  in  the  actuator  case.  The  screw 
could  both  rotate  and  move  axially.  Each  motor  could  give  the  full  output  shaft  travel 
if  the  other  motor  was  held.  Motor  A  was  driven  by  one  lane  of  the  electronic  system, 
motor  B  by  the  other  lane.  In  normal  operation  each  motor  contributed  equally  to  the 
output  travel  and  in  this  condition  full  output  travel  was  achieved  by  a  single  revolution 
of  each  motor. 

Two  independent  L.V.D.T. 's  were  used  to  monitor  the  output  movement. 

The  motors  were  of  the  variable  reluctance  type  and,  therefore,  had  no  detent 
torque.  We  provided  the  fail-frozen  action  oy  using  friction  brakes,  one  for  each  motor. 
We  designed  the  brakes  to  hold  the  appropriate  motor  in  the  event  of  power  being  cut  off 
from  one  motor  and  full  drive  being  obtained  from  the  other  motor.  Whilst  this  gave  a 
continuously  parasitic  drag  on  the  motors  it  did  provide  a  simple  brake  mechanism. 

Thus,  we  had  the  driving  mechanism  to  consolidate  two  electronic  control  channels. 
Faults  were  detected  by  comparing  the  rotations  of  the  two  motors  in  a  bevel  gear 
differential  situated  between  them.  Any  significant  discrepancy  between  the  motor 
rotations  resulted  in  a  movement  of  the  differential  drum  which  caused  electrical  switches 
to  be  operated  according  to  the  direction  of  its  rotation  and  the  angular  displacement. 
Operation  of  these  switches  indicated  the  presence  of  a  fault  in  one  of  the  control  lanes. 


As  mentioned  earlier,  over  1500  operating  hours  were  obtained  on  these  units  and 
invaluable  experience  was  gained.  Problems  occurred  due  to  unpredictable  fraction  levels 
experienced  late  in  the  test  periods.  The  effect  was  to  cause  random  but  correlated 
stalling  of  both  motors.  The  maximum  torque  of  each  motor  was  not  identical  and  as 
friction  built  up  the  lower  torque  motor  stalled  first.  The  system  recovered  by  switching 
correctly  to  single  motor  operation  but  the  second  motor  stalled  almost  immediately  and 
the  system  then  froze  the  actuator  in  correct  response  to  an  apparent  double  failure. 

We  have  already  mentioned  two  of  the  many  lessons  learned  from  this  experience  - 
consider  the  external  environment  very  carefully  for  "common  mode"  faults  which  affect 
both  lanes  of  control  and  consolidate  the  lanes  as  far  into  the  system  as  possible. 

There  were  others. 


The  instrumentation  originally  used  on  the  tests  was  adapted  to  checking  the  control 
performance  in  terms  of  engine  behaviour.  It  did  not  help  to  identify  the  me  ihanism 
which  caused  the  freezing  of  the  output.  Clear  understanding  of  the  sequence  of  events 
was  only  obtained  after  instrumenting  the  interface  unit.  We  have  since  developed  an 
on-line  recording  and  analysis  system  which  allows  us  to  monitor  a  large  number  of 
variables  and  gives  us  great  flexibility  and  rapidity  in  dealing  with  the  data  recorded 
on  magnetic  tape.  We  use  the  system  to  record  not  only  all  the  running  carried  out 
but  the  control  programme  m  use  at  the  time.  Both  are  stored  indefinitely  for  future 
reference. 


There  were  also  lessons  for  the  design  of  the  interface. 

A  larger  torque  margin  from  the  motors  would  have  overcome  the  friction;  alternatively 
a  braking  system  which  operated  only  when  a  system  failure  was  registered  would  have  made 
optimum  use  of  the  motor  output. 

Similar  manfunctions  occurred  due  to  fuel  borne  solid  contaminant  causing  excessive 
stiction  in  the  nut  and  screw  assembly  and  in  the  motor  bearings.  This  could  be  overcome 
be  arranging  for  better  filtration.  We  concluded  that  a  simpler  mechanism  was  desirable 
and,  m  turn,  this  directed  our  attention  to  the  design  of  the  hydro nechanical  units 
using  mechanisms  requiring  minimal  force  or  torque  outputs  from  the  actuator  and  using 
rotary  ratner  than  linear  movements  to  simplify  the  translation  of  the  basic  motor  move¬ 
ment.  Our  current  work  includes  the  evaluation  of  an  actuator  using  two  motors  on  a 
common  shaft.  This  gives  a  simple  mechanical  arrangement  but  adversely  affects  the  motor 
dynamics  due  to  the  increased  rotor  inertia  for  the  active  motor. 

Helicopter  Interface 


As  mentioned  earlier,  Fig.  11,  shows  the  interface  unit  for  a  helicopter  control. 
Here  we  propose  to  use  two  identical  stepper  motor/gear  box  assemblies  each  driving  a 
complementary  part  of  the  fuel  metering  valve.  The  'main'  control  lane  drives  one  of 
the  motor  assemblies  which  rotates  a  cam-like  plate  the  edge  profile  of  which  is  used  to 
form  the  metering  area  for  the  fuel.  The  plate  rotates  in  conjunction  with  a  metering 
orifice  which  m  turn  can  be  rotated  independently  by  the  other  motor  assembly  driven  by 
the  reversionary  lane  of  the  engine  controller.  In  normal  operation  the  reversionary 
motor  is  held  electrically  by  a  fixed  power  phase  pattern  applied  to  its  stator,  whilst 
normal  control  is  provided  via  the  main  lane  and  its  motor.  If  a  fault  occurs  in  the 
main  lane,  control  of  the  engine  is  obtained  through  the  reversionary  lane  via  the 
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reversionary  motor  whilst  the  mam  motor  is  held.  The  gearing  is  arranged  so  that  if  a 
fault  develops  in  the  reversionary  motor  lane  during  normal  operation,  Such  that  the 
orifice  element  rotates,  the  main  control  can  maintain  correct  relative  position  of  the 
cam  plate  and  the  orifice. 

Each  stepper  motor  assembly  is  mechanically  geared  to  a  resolver  to  enable  the 
relative  positions  to  be  monitored.  These  resolvers  are  not  shown  in  Fig.  11. 

VTOL  Interface 


A  basic  representation  of  an  interface  unit  proposed  for  an  engine  such  as  Pegasus 
has  completed  several  hundred  hours  operation  on  a  Pegasus  engine.  The  actuator  part 
of  the  unit  used  a  stepper  motor,  gearhead  and  resolver  and  we  have  arranged  this  to  drive 
a  rack  to  move  a  pivot  in  the  hydromechanical  mechanism.  This  unit  senses  P3  in  the 
hydromechanics  and  the  stepper  motor  position  sets  a  Wf/Pj  value. 

The  complete  unit  can  be  operated  with  a  variety  of  full  authority  electronic  control 
configurations  ranging  from  a  single  main  lane  to  a  full  duplicated  arrangement  or  with 
varying  pre-determined  degrees  of  control  degradation  in  the  reversionary  lane.  A  unit 
of  this  type  has  been  run  not  only  with  automatic  reversion  to  a  manual  fuel  controller 
with  minimal  change  in  engine  thrust  but  also  with  an  existing,  well-proven,  production 
manual  fuel  control  which  involves  an  excursion  in  engine  power  during  changeover.  A 
variant  of  this  unit  uses  a  dual  motor  assembly. 

In  contrast  to  the  designs  mentioned  earlier,  the  motor  in  this  actuator  cannot 
rotate  indefinitely  but  has  positive  end-stops.  We  originally  provided  excessive 
compliance  in  these  end  stops  and  this  caused  the  stepper  motor  to  be  back-driven  as 
their  deflection  was  restored. 

This  gave  rise  to  anomalous  rotation  of  the  motor.  The  natural  frequency  of  the 
motor/end  stop  system  was  such  that,  when  the  motor  was  continuously  driven  against  the 
end  stops,  the  drive  pulses  were  applied  at  the  instant  the  motor  was  being  back-driven. 
The  motor  then  continued  to  be  driven  but  in  the  reverse  sense. 

Various  forms  of  anomalous  behaviour  can  also  be  observed  if  the  motor  is  under 
damped.  Current  drive,  unipolar  drive  and  excessive  drive  power  all  result  in  reduced 
damping  and  have  produced  mysterious  effects  only  clearly  explained  by  properly 
instrumenting  the  interface  unit. 

Conclusion 


In  this  paper  we  have  considered  redundancy  in  its  various  forms  and  drawn  upon  our 
experience  of  more  than  10  years,  with  redundant  digital  systems. 

We  have  described  bad  experience  as  well  as  good  because  each  is  of  value  to  us. 

We  hope  that  in  this  presentation  we  have  gone  some  way  towards  answering  tne 
'cri  de  coeur'  of  the  engine  control  designer  who,  after  a  long,  hot  and  frustrating  day 
on  an  engine  test  bed  said: 

"Electronics  is  electronics,  hydromechanics  is  hydromechanics,  but  interfaces  are 
just  a  can  of  worms!" 


Acknowledgements 

The  authors  wish  to  acknowledge  the  work  done  by  their  colleagues  within  Dowty  and 
Smiths  Industries  Control  Limited.  Their  efforts  have  led  to  the  accumulation  of 
experience  from  which  this  paper  has  been  drawn.  Recognition  is  due  also  to  the  support 
received  from  M.o.D. (P.E. ) . 

They  thank  the  directors  of  Dowty  and  Smiths  Industries  Controls  Limited  for 
permission  to  publish  this  paper  although  the  views  expressed  are  entirely  their  own. 


FLOW 


-  WIDELY  USED  ON  MANY  ENGINES. 

MAY  USE  TWO  VALVES  AS  SHOWN  OR  A  SINGLE  VALVE. 
-  REQUIRES  PERIODIC  CHECKS  FOR  LATENT  FAILURE. 


Figure  1 

Overspeed  Limiter 


ADVANTAGES 

-  EASY  TO  CERTIFICATE, 

- •  ELECTRONIC  CONTROL  NOT  A  DESPATCH  ITEM. 

-  SYSTEM  AVAILABILITY  REASONABLY  HIGH. 

-  BENEFITS  OF  SOPHISTICATED  CONTROL  WHEN  AVAILABLE. 

DISADVANTAGES 

-  RELIABILITY/MAINTENANCE/WEIGHT  BURDEN. 

F'ULL  BASIC  CONTROL  CAPABILITY  NEEDED. 

Figure  2 

Supervisory  System 


SENSORS 

Figure  3 

PS 50  Engine  System 
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Figure  6 

Adour  Engine  Controller 


-  MAJOR  CHANGE  IN  PERFORMANCE  ON  FIRS!  FAILURE 

- CHANGEOVER  MAY  NEED  TO  BE  AUTOMATIC. 

-  LEVELS  OF  SAFETY  DEPEND  ON  SERVICE  AND  TIMES  AT  RISK 

-  FULL  CONTROL  AVAILABILITY  NEEDED  FOR  DESPATCH 

-  BACK  UP  AND  HYDROMECHANICAL  CONTROL  SECTIONS  CAN  BE  SIMPLIFIED. 
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REVERSIONARY. 

MOTOR 


CONDITION  LEVERS 


Figure  10 

Twin  Engined  Helicopter  System 


Figure  11 

Section  through  Metering  Valve 
For  Helicopter  Fuel  Control 
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DISCUSSION 


G.E. Davies,  UK 

Keyword:  Interfaces.  I  would  agree  with  your  final  comment  that  .nterfuces  are  “just  a  can  of  worms”  and  I  am 
thinking  more  particularly  of  the  input  interfaces.  This  may  be  because  the  engine  performance  people,  the  control 
system  designers,  and  the  transducers  manufacturers  do  not  get  together  enough  to  discuss  their  requirements  This 
then  results  in  non-optimuin  systems  being  specified  because  control  system  specifications  are  written  around  avail¬ 
able  equipment,  and  transducer  manufacturers  do  not  know  what  is  really  required.  Can  you  comment  please? 

Author’s  Reply 

There  is  always  room  for  improvement  in  communications  between  technologists  of  all  disciplines  and  this  was  one 
of  the  factors  that  led  Dowty’s  and  Smiths  to  join  forces  many  years  ago.  Over  the  years,  there  has  been  steady 
progress  in  mutual  enlightenment  and  in-house  transducer  development  evolving  from  closer  liaison  with  the  engine 
manufacturer  and  Government  technical  establishments. 

Generally,  our  requirements  for  transducers  have  not  been  met  by  “off-the-shelf”  items,  due  to  hostile  environ¬ 
ments,  stringent  accuracy  requirements  and  special  to  type  interfacing  for  engine  controls.  The  high  technical  risk 
m  the  new  technologies  seems  to  have  discouraged  investment  and  interest  from  the  specialised  suppliers  pending  the 
evolution  of  a  clearer  and  more  positive  market. 

There  are  signs  that  specialist  manufacturers  outside  the  immediate  engine  controls  field  are  becoming  more  inter¬ 
ested  and  no  doubt  this  will  be  stimulated  more  as  development  of  electronic  control  systems  proceeds. 

From  a  physical  standpoint,  none  of  the  engine  parameters  are  inherently  in  true  digital  form.  Hence,  they  all 
require  a  greater  or  lesser  degree  of  modelling  m  the  digitising  process  Even  speed  and  other  frequency  signals 
require  a  precise  hardware  time  model  in  the  form  of  a  crystal  clock  or  R/C  circuit.  The  essential  problem  of  trans¬ 
ducer  design  is  thus  the  finding  of  suitable  environmentally  stable  mechanical,  hydromechanical  or  pneumatic 
models  which  will  tran? "  rm  the  analogue  engine  parameter  either  into  an  analogue  or  digital  encoded  signal  which 
can  be  transmitted  from  the  measuring  point  to  the  controller  To  date,  the  number  of  such  modellmg/transnussion 
techniques  with  adequate  environmental  capability  has  been  restricted. 

Overall  control  design  has  thus  always  required  coinpiomist>  between  system  requirements  transducer  locations 
and  current  transducer  availability  and  needed  close  liaison  between  the  yanous  disciplines. 
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CONDUITE  DES  MOTEURS  DE  LA  NOUVELLE  FAMILLE  AIRBUS 
par 

Jean-Claude  Tchavdfrov 

Ingenieur  au  Bureau  d1  Etudes  Installation  Motnce 
de  la  S. II. I. AEROSPATIALE 
316,  route  de  Bayonne  -  B.P.  3153 
31053  -  Toulouse  oedex 
France 


La  premiere  partie  situe  le  probleme  general  de 
la  conduite  moteur,  avec  les  objectifs  a  satisfaire,  et 
ies  grands  pnncipes  retenus. 

La  seconde  partie  donne  une  description  de  la 
conduite  des  moteurs  de  l'AIRBUS  A  300  :  commands  des 
gaz,  regulation  hydroinecanique ,  instrumentation  pnnci- 
pale  moteurs,  tlieone  et  choix  du  parametre  de  conduite, 
systemes  automatiques  associes,,  procedures  operationnel- 
les. 

La  troisieme  partie  presente  les  solutions  qui 
sont  envisagees  aujourd'hui  pour  les  futurs  AIRBUS  A510, 
en  particulier  par  1' introduction  de  regulations  par- 
tiellement  electroniques. 


LI3TE  DES  SYMBOLES 

ACT  :  Actuator,-  servo-moteur  d'automanotte 
ADC  :  Air  Data  Computer,  centrale  anemometrique 
AEL  ;  Afficheur  EPR  nmite 
ANL  :  Afficheur  N1  limite 
CEL  :  Calculateur  EPR  limite 
CL  :  Climb,  mode  de  conduite  montde 
CNL  :  Calculateur  HI  limite 
OR  :  Cruise,  mode  de  conduite  croisiere 

EC  :■  Electz-omc  Control,  boitier  de  regulation  electronique 
EGT  :  Exhaust  Gas  Temperature,  temperature  ejection  des  gaz 
EPR  :  Engine  Pressure  Ratio  PT7/PT2,  rapport  de  pression  du  moteur  (PWA) 

FLX  TEMP  :  flexible  Temperature,  temperature  fietive  decollage  pousseo  adaptee 
FLX  TO  :  Flexible  Take-off,,  decollage  a  poussee  adaptc-e 
GA  :■  Go-Around,  reraise  des  gar 
GE  :  General  Electric 

HMC  :  Hydromecnamcal  control,  re'gulateur  hydromVcanique- 
M  :  Hombre  do  Mach 

MCT  :  Maximum  continuous,  mole  de  conduite  maximum  contmu 
N1  :  Vite  sse  de  rotation  de  la  souffla.nte 
H2  :  Vitesse  de  rotation  du  mobile  haute  pression 
UAT  :•  Outside-  Air  Temperature,  temperature  statiquo  exh'rieuro 
PLA  :  Power  Lever  Angle ,  angle  du  levier  des  gaz  sur  moteur 
PT2  :  Pression  totals  entree  moteur 

PT7  :  Pression  totale  sortie  turbine  basso  pression  (PWA) 

PVIA  :■  Pratt  &  Whitney  Aircraft 

RPM  :  Revolution  Per  Minute,  tour  par  minute 

TAT  ;  Total  Air  Temperature,,  temperature  *■-  tale 

TOC  :  Thrust  Control  Computer,  calculateur  de  poussee 

TLA  :  Turns t  Lever  Angle,  angle  manetti  au  paste  1c  pil  iag-. 

TO  :  Taxe-Off,  mode  de  conduite  decollate 
TRP  :  Thrust  Rating  Panel,  afficheur  de  poussCe 
TT2  :■  Temperature  total-,  entri'e  moteur 
2  :•  Altitude 


0.  Ii.TRODUCTIOi, 

De  grands  rr.gr'o  .it  't*'  fait-  ee  qui  e.:.c-r-e  les  tears  a  r-'acti.ns  pour  les  avi.ns  civile  des 
dix  der.uiereo  aur.-'uj.  Les  turn  j-r-'ac tours  simple  iiuX  .u  d -onle  flux  \  tr'_-  faiole  tau/  de  diluii.n  -j.t 
rajiJor,e..t  fait  place  a  jl  turo.-r  'acte-rs  deutle  fl-jc  i  ta^x  d.  d’lutien  -  lev'  et  7  reuss/c  tr.o  imp  rtan- 

E,  parall  le,  ies  regulation-  d-.o  r.uurn  nas-'  c  -ur  des  pr.ncip-s  nydr  "  jan.qu.s  c.t  o-'ne'fz ’!•'  d‘ 
a-  'li. rati  :.s  n  tatles.  L  s  1.  r-llt.  e-.pt.. 1-  _  .  jct-'i-.-u  avi  ...t  ie-ni.  i'accr  lire  .-re  la  qua- 
l.i'  des  r 'efuiatims  t' ut  dr-i.ruan:  la  oiiarg-  _---3  t'ouipages,  parte-'uli' r.  r.-.it  par  l'l’.tr.ducti.:  u_e 
•sliuiat- „rs  Jo  r  us.-'e.  -1  limit.,  EP.t  l.mit-  t  it  t  ..ela -e  de  c-  uX-  ■_  a;-  ■  1  o,ct  me  i'a.t  -an-  tt.  . 
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Par  ailleurs,  le  developpement  des  technologies  basees  sur  1' electronique  et  1 ' electricite  tar.t  pour 
les  systemes  avions  tels  que  commandes  de  vol  et  conmanc.es  de  gaz,  que  pour  les  regulations  en  general,  a 
naturellement  conduit  les  motoristes  et  les  avionneurs  a  mtroduire  au  moins  partiellemer.t  ces  techniques 
dans  les  systemes  de  conduite  des  reaoteurs.  he  but  recherche  dans  cette  approche  est  double  :  economies 
sur  la  consommation  et  l'usure  du  moteur,  et  reduction  de  la  charge  de  travail  de  1' equipage. 

le  but  du  present  document  est  d' exposer  les  prmcipes  di  systeme  de  conduite  des  moteurs  installes 
actuellement  sur  1'AIRBUS  A  300,  ainsi  que  les  solutiors  envisagees  pour  la  nouvelle  famine  AIRBUS  A  310 
et  eventuellement  A  300,  par  introduction  de  regulations  partiellement  electroniques. 


1 .  PROBLEKE  GENERAL  DE  LA  CONDUITE  MOTEURS 

On  peut  defimr  la  conduite  des  moteurs  d'avion  comme  etant  l'ensemble  des  systemes  et  des  operations 
necessaires  pour  determiner  et  pour  maintenir  sur  les  moteurs  la  poussee  requise  pour  chaque  phase  de  vol 
successive. 

L'objectif  principal  a  attemdre  est  double.  11  faut  d'une  part  dtre  sur  de  l'obtention  de  la  poussee 
eo  ce,  avec  la  precision  attendue  ;  d'autre  part,  ll  faut  Stre  sur  de  ne  pas  depasser  les  limitations  du 
moteur  en  regimes  et  en  temperature,  ceci  afm  de  conserver  la  securite  requise,  mais  aussi  dans  le  but  de 
preserver  la  duree  de  vie  des  moteurs  et  de  reduire  les  codts  de  leur  maintenance. 

Les  autres  objectifs  ne  sont  pas  a  negliger.  Le  systeme  doit  presenter  une  grande  simplicity  de  mise 
en  oeuvre  et  d'utilisation,  afin  de  reduire  au  maximum  la  charge  de  1' equipage.  Ceci  est  de  plus  en  plus 
important  compte-tenu  du  degre  croissant  de  sophistication  des  avions  actuels  et  des  tendances  de  nombreu- 
ses  compagnies  aeriennes  a  reduire  le  nombre  de  raembres  d' equipage. 

Enfin,  les  evolutions  recherchees  par  les  motonsi.es  et  les  avionneurs  doivent  conduire  a  une  reduc¬ 
tion  de  la  consommation  specifique  et  des  coGts  de  maintenance  des  moteurs. 

Ces  objectifs  sont  attemts  au  moyen  de  differents  systemes.  La  commande  des  gaz  permet  au  pilote 
d'agir  directement  mais  manueilement  sur  le  regulateur  hydromecanique  du  moteur  qui  assure  le  dosage  cor¬ 
respondent  du  debit  carburant.  En  parallele,  le  pilote  a  la  charge  de  surveiller  1' evolution  des  parame- 
tres  pnneipaux  du  moteur  (vitesses  de  rotation  des  mobiles  et  temperature  de  gaz  essentiellementj  ot  doit 
s'assurer  q  e  les  limites  presentes  ("marques  rouges”  des  indicateurs)  ne  sont  pas  attemtes.  En  comple¬ 
ment  a  ces  actions  manuelles,  le  pilote  dispose  mamtenant  de  systemes  automatiques  qui  allegent  sa  tdche. 
D'une  part,  le  calculateur  de  poussee  determine  et  affiche  en  permanence  la  poussee  limite  dispomble  se- 
lcn  la  phase  de  vol  sous  la  forme  d'un  parametre  dit  parametre  de  conduite  qui  a  ete  retenu  par  le  moto- 
nste  oomme  etant  le  plus  representatif  dc  la  poussee  du  moteur.  D'autre  part,  le  couplage  de  cette  indi¬ 
cation  de  poussee  limite  avec  le  calculateur  d'automanette  permet  d'assurer  automatiquement  par  simple 
pression  d'un  bouton  l'obtention  et  le  maintien  sur  le  moteur  de  la  poussee  reelle  recherchee. 

Nous  ternunerons  ce  chapitre  de  generalites  sur  la  conduite  des  moteurs  par  deux  remarques  essentiel- 

les. 

La  premiere  concerne  1' importance  du  compromis  performance  avion  /  duree  de  vie,  done  coGt  de  mainte¬ 
nance  du  moteur.  L'objectjf  recherche  sur  ce  point  ne  sera  atteint  que  si  le  calcul  et  l'obtention  du 
parametre  de  conduite  representant  la  poussee  sont  effeetues  avec  une  grande  precision,,  d'ou  1' importance 
de  la  quality  des  processus  de  calcul  et  de  la  chnine  d 'asservissement  calculateur  de  poussee  -  calcula¬ 
teur  d'automanette  -  commande  des  gaz  -  r ogulateur  hydromecanique. 

Bans  la  deuxieme  remarque,  nous  vuulons  seulement  rappeler  1' importance  des  decollages  et  eventuel- 
lement  des  montees  effeetues  en-dessous  de  la  poussee  limite.  Ces  procedures  agissent  directement  sur 
l'usure  du  moteur  et  done  sur  le  coGt  de  sa  maintenance.. 


2.  CONDUITE  DES  MOTEURS  DE  L' AIRBUS  A  300 

L'AIRBUS  A  300  est  mamtenant  presente  comme  pouvant,  §tre  equipe  de  deux  families  de  moteurs  : 

-  famille  CK-50  (C,  Cl,  C2,  C2R)  de  General  Electric 

-  famille  JT9D  (-  59A)  de  Pratt  &  Whitney. 

Lvs  deux  moteurs  sont  evidemment  tres  voisins  en  ce  qui  concerne  la  poussee  developpee,  la  constitu¬ 
tion  interne  et  le  mode  de  regulat-on.  La  difference  essentielle  qu'il  nous  est  important  de  connaitre 
pour  le  sujet  traite  dans  ce  document  est  le  choix  du  motonste  en  ce  qui  concerne  le  parametre  de  condui¬ 
te  representant  la  poussee,  choix  sur  leqael  nous  reviendrons  ulterieurement . 

Dans  le  present  chapitre  nous  nous  mteresserons  successiveuent  aux  sujet3  suivants  :  commande  des 
gaz  et  functions  du  regulateur  hydromecanique,,  instrumentation  pnncipale  du  moteur,  choix  du  parametre  de 
conduite  et  theone  de  la  conduite  proprement  dite,  systemes  automatiques  de  1' avion  :  calouiateurs  de 
poussee  et  automanette,  utilisation  de  ces  differents  systemes. 

Le  systeme  de  commande  moteur  est  compose  d'un  ensemble  cflble  -  poulie  depuis  le  poste  de  pilotage 
jusqu'a  u’  tambour  de  transfert  pour  la  commande  des  gaz  et  de  l'mverseur  de  poussee,  et  d'un  actionneur 
olectrique  lmeaire  pour  l'ouverture  du  robmetHP  ue  carburant. 

Le  tar.t  our  de  transfert  est  mstalle  dans  le  mfit  en  avant  de  la  liaison  prinoipale  m&l  -  voilure  et 
transforms  an  mouvement  circulaire  en  un  mouvement  lmeaire  de  commande  par  cfible  "push-pull"  relit  au 

guign  1  de  oorjiande  des  gaz  sur  le  regulateur  de  carburant.  Le  cfible  chemir.e  sur  le  cSte  gauche  du  carter 

de  a-  ufflante  et  attaque  un  ensemble  bielle-guignol  lie  au  guignol  du  regulateur. 

Par  ailleurs,  le  tambour  de  transfert  dans  le  mSt  est  re-1  i *-  au  distnbuteur  de  commande  de  l'mver- 
seur  dt  pouss.'e  amsi  qu'a  la  butee  d' interdiction  empSchant  la  case  des  gaz  tant  que  les  obstacles  de 
l'mverseur  sor.t  en  transit. 

L'actior.neur  --lectrique  lmeaire  est  mstalle  au  voismage  du  tamDour  de  transfert  et  est  relie  au 
guignol  de  o.mmando  du  roiunet  iff  sur  le  regulateur  par  une  commande  similaire  a  la  commande  des  gaz. 

Cette  commando  des  gaz  ag-t  directement  sur  le  "levicr  de  puissance"  (Power  lever)  du  regulateur 

.hydromecanique  l\ot  les  fcnctior.s  sont  les  suivante-s.  En  premier  lieu,  il  assure  la  regulation  du  regime 
1.2  da  mobil?  haute  pression  par  dosage  du  debit  carburant.  Ga  function  secondaire,  mais  non  meins  impor- 
tar.te,  est  ie  preserver  le  moteur  vis-a-vis  des  limites  de  pompage  notamment  pendant  les  phases  a'acce- 
1  'rati et  de-  i-’c  'lerati.u  -,i.  regime.  Ceci  est  otter.u  pour  les  deux  moteurs  GE  et  PWA  par  1  ’action  con.fi- 

i.i  r.'g-.lateur  sur  le  calag--  k-s  adapts  fixes  de  c  npresseur  et  sur  la  commands  de-  vanne-s  de  decaarge 
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de  l'air  du  conpresseur  dans  le  canal  de  soufflante. 

La  figure  1  montre  le  schema  de  la  regulation  hydromecanique  du  moteur  PWA-JT9D 


FIGURE  1 

REGULATION  HYDROMECANIQUE  DU  JT9D 


L1 instrumentation  princ^pale  du  moteur  corprend  les  paramotres  suivants  : 

-  Rapport  do  pression  sortie/entree  du  notour,  EPR  :•  moteur  PWA  seuloment,  pai’ametre  de  conduite 

-  Vitesse  do  rotation  de  la  3oufflante,  Hi  :  moteurs  GE  et  PWA,  paramutre  de  conduite  du  moteur  GE 

-  Temperature  entree  ou  sortie  turbine  basse  prossoon,  EGT  :  moteurs  GE  (entree)  et  PWA  (sortie) 

-  Vitesse  de  rotation  du  mobile  haute  pression,  112  :  moteurs  GE  et  PWA 

-  Debit  carburant. 

Los  mdicateurs,  au  nombre  de  un  par  paramutre  et  par  moteur,,  sent  au  format  2  ATI  et  sont  situes  sur 
la  partie  central?  de  la  plar.ehe  pilote. 

a)  L'mdicateur  EPR  comprend  les  elements  suivants  :• 

.  une  aiguille  mdiquant  la  valeur  de  l’EPR  dans  la  plage  0,8  a  1,8 

.  un  repetiteur  digital  a  quatre  tambours  dans  la  partie  mfe'ricure  do  l'mdicateur.  II  mdique  la 
valeur  de  l'SPR  avec  precision  dans  la  plage  C,8  a  1,8.  Le  dernier  tambour  correspond  a  0,001  EPR 

.  un  index  mobile  a  la  peripheric  du  cadran  mdiquant  la  valeur  de  l'EPR  limite 

.  un  re'pe'titeur  digital  a  quatre  tambours  de  la  valeur  de  l'EPR  limite  dans  la  partie  supenoure  de 
l'mdicateur  (non  autonaiique) 

.  un  ocuton  de  commande  de  1' index  et  du  compteur  EPR  limite  (non  automatique) 

.  ui'C  chaine  de  dupassenent  fourmssant  un  signal  de  comparaison  entre  EPR  reel  et  EPR  limite  pour 
le  syst'.-me  autumanette 

.  un  snitch  ue  test  qui  cinule  le  fenctiunnement  de  l'mdicateur  pour  une  valeur  particuliere  de 
l'EPR. 

En  m.'d'  aut  uatiquu,  c'est-i-dire  par  couplage  avec  le  calculateur  EPR  limite,  le  bouton  de  com¬ 
mand  ■  dtjd  citi'  tut  pmss*',  l1  index  mobile-  de  l'EPR  limit?  est  cu.-maude  par  une  sortie  du  calculateur,  et 
le  rep.'tituur  digital  est  masquC.  En  node  nanutl,  le  bouton  le  commande  est  tin'  et  sa  rotation  entraiue 
a  la  f  is  1* index  mobile  et  le  rep.'tituur  digital  qui  est  apparent.  La  valeur  de  EPR  limite  affichee  par 
l'-'quipago  c.u  l’mdicateur  au  reyen  d'  ce-  bouton  dc  cemaande  est  releve'c  sur  les  courbes  de  cmduite  mo- 
t.ur  du  Kanuel  ue  Vo I. 

t)  L'mdicateur  M  adept1'  au  moteur  GE  est  iris  voism  de  l'mdicateur  EPR  amt  nous  venons  de  par¬ 
lor.  I.  affioue  la  val  ui  u,  M  lans  la  plage  0  j  125  7  RPK,  avec  une  pr'cismn  de  lecture  de*  0,1  7  M 
m  le  r.'p.'tit 'ir  digital.  I.ntes  les  autres  foncti  ns  precodemno-nt  d>'critos  pour  l’mdicateur  EPR  restout 
i:  mangoes ,  dc  memo  quo  jec  r.  odes  u’  utilmati L'mdicateur  N1  conrorte  ec  plus  une  aigu.lle  a'mdica- 
ti.i.  ue  la  valuer  inxirale  at  mints  qui  est  <  ntralio't  par  l'aeguillo  prn.cipale  au-dula  de  la  limite  de 
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c)  L'indicateur  EGT  comprend  les  elements  suivants  :  1 

.  une  aiguille  indiquant  la  valeur  de  l'EGT  dans  la  plage  0  a  1000°  C.  Le  cadran  comprend  des  pla¬ 
ges  de  couleur  jaune  et  rouge  correspondant  aux  differentes  limites  d'utilisation, 

.  un  compteur  digital  a  3  tambours  dans  la  partie  infeneure  de  l'indicateur..  Le  dernier  tambour 
correspond  a  1°C, 

.  une  chaine  de  detection  et  de  signaliaation  des  depassements, 

.  une  aiguille  d1 indication  de  la  valeur  maxiraale  atteinte  qui  est  entrainee  par  1' aiguille  prin¬ 
cipals  au-dela  dc  la  limite  de  temperature  correspondante , 

.  un  switch  de  test  qui  simule  le  fonctionnement  de  l'indicateur  pour  une  valeur  particuliere  de 
l'EGT..* 

d)  L'indicateur  N2  comprend  les  elements  suivants  : 

.  une  aiguille  indiquant  la  valeur  du  I»2  dans  la  plage  0  a  1 20  fo  RPM.  Le  cadran  comporte  un  index 
rouge  correspondant  a  la  valeur  limite  d'utilisation, 

•.  un  compteur  digital  a  quatre  tambours  dans  la  partie  mferieure  de  l'indicateur.  Le  dernier  tam¬ 
bour  mdique  0,1  $  N2, 

.  une  chaine  de  detection  des  depassements, 

.  une  aiguille  d' indication  de  la  valeur  maximale  atteinte  qui  est  entrainee  par  1' aiguille  prin¬ 
cipals  au-dela  de  la  limite  de  survi tease, 

.  un  switch  de  test  qui  simule  le  fonctionnement  de  l'indicateur  pour  une  valeur  particuliere  du 
N2, 

•  un  switch  a  transistor  fournissant  un  signal  de  fermeture  utilise  par  le  circuit  de  demarrage 
pour  une  valeur  particuliere  du  N2. 

e)  L'indicateur  de  debit  carburant  comprend  les  elements  suivants  : 

.  une  aiguille  indiquant  le  debit  massique  dans  la  plage  0  a  12.500  Kg/h  ou  0  a  27.000  lb/h, 

.  un  compteur  digital  a  quatre  tambours  dans  la  partie  infeneure  de  l'indicateur.  Le  dernier  tam¬ 
bour  indique  les  dizaines  de  kg/h  ou  de  lb/h. 

Ccmme  nous  l'avons  doja  indique,  le  parametre  de  conduite  choisi  par  le  mofconste  est  l'EPR  pour  le 
moteur  Pratt  &  Whitney  et  le  regime  N1  pour  le  General  Electric.  Chaque  motorists  demontre  que  la  relation 
ertre  la  poussee  et  le  parametre  qu'il  a  choisi  est  conservee  avec  une  bonne  precision  pcix  tows  les  mo- 
teurs.  Cette  demonstration  est  basee  ossentiellement  sur  des  escsais  effectues  sur  un  certain  nombre  du  mo- 
teurs.-  Il  est  amst  prouve  que  le  parametre  choisi  represente  la  poussee. 

Sans  vouloir  intervenir  sur  les  raisons  des  ohoix  effectues,  nous  pouvons  dire  que  l'avantagu  essen- 
tiol  en  faveur  du  N1  est  sa  simplicite  de  raise  ei.  oeuvre,  alors  que  la  poussee  semble  plus  directement 
liee  a  l'EPR. 

Etant  donne  1' existence  de  la  relation  poussee  -  parametre  de  conduite,  on  definit  pour  chaque  phase 
de  vol  des  ooarbes  de  conduite  dormant  la  valeur  du  N1  ou  de  l'EPR  de  faqon  L.  obterur  exactemer.t  la  pous¬ 
see  necessaire.  Six  modes  de  conduite  ont  ete  retenus  pour  representer  les  duferer.tes  phases  de  vol  : 
decullage,  decollage  a  poussee  adaptee,  maximum  montee,  maximum  croisiere,  maximum  oontinu  et  remise  des 
gaz.  Pour  chacun  de  ces  modes,  est  definie  une  courbe  dormant  le  N1  ou  l'EPR  en  fonction  de  la  temperature 
totals1  et  de  l'altitude  piession.  Chaque  coui’be  est  ecrStce  a  une  valeur  maximale  en-dessous  d'une  certaine 
temperature  dite  temperature  de  cassure  uu  temperature  de  flat  rating.  En-dessous  de  oette  temperature,  la 
poussee  ieste  approximativement  constante.  Au-dessus,  la  pousscu  decroit  avec  la  temperature  totale  TAT,  de 
fapon  a  conserve1"  toujuurs  une  legere  marge  par  rapport  a  la  temperature  d'EGT  limite  correspondanc  au  mode 
considere.  Chaque  regime  est  done  defini  par  deux  donnees  : 

-  une  courbe  de  limitation  en  EST  qui  peut  §tre  representee  par  un  polynfime  en  TAT  de  degre  mfe- 
rieur  ou  egal  a  cinq, 

-  une  temperature  de  cassure  (flat  rating),  definie  par  un  ecart  par  rapport  a  la  temperature  ISA  en 
fonction  do  l'altitude.  Amsi,:  pour  chaque  mode  de  conduite,  la  poussee  maximale  est  definie  au 
moyen  d'une  courbe  donnant  le  parametre  de  conduite,  semblable  a  celle  schematisee  sur  la  figure 
2  a  titre  d'exemple. 

Chaque  courbe  est  atablie  pour  une  configuration  particuliere  de  preluvements  d'air  :  aucun  prelbve- 
ment  pour  le  decollage  et  le  ducollage  a  poussee  adaptee,  prulevements  pour  le  seul  systume  de  conditionne- 
ment  d'air  pour  les  quatre  autres  modes.  Pour  les  auLres  configurations  de  preluvements,  des  corrections 
sont  apportees  au  111  ou  EPR.  Ces  corrections  dependent  de  la  quantite  de  systumes  alimentes  par  1'air  pru- 
leve  sur  le  reacteur  et  sont  donnees  en  fonction  de  l'altitude. 

Le  decollage  a  poussee  adaptee  peut  8tre  utilise  chaque  fois  que  la  masse  reelle  de  l’avion  au  decol¬ 
lage  est  infeneure  a  la  masse  maximalo  autorisee.  Comme  cette  derniere  decroit  quand  la  temperature  cruit, 
il  est  possible  de  faire  correspondre  une  temperature  fictive  e  la  masse  reelle  de  1' avion.  Cette  tempera 
ture  est  appelee  "Flexible  temperature"  et  est  donnee  pour  un  aeroport  et  un  type  d 'avion  donnes  par  la 
fiche  de  terrain  en  fonction  de  la  masse  ae  l'avion  et  compte-tenu  de  la  TAT  (=  OAT)  locale  du  Jour  consi¬ 
ders;.  La  poussee  ainsi  obtenue  est  parfaitement  adaptee  a  la  masse  reelle  de  l'avion,  de  sorte  qu'en  cas 
dt  panne  d'un  moteur  au  decollage,  celui-ci  est  effectue  dans  les  m@mes  conditions  de  secunte  qu'un  decol- 
lage  normal  sans  aucune  action  particuliere  de  l'equipage.  Le  pourcentage  maximal  de  reduction  ue  poussee 
en  "FLEX  TO"  est  aujourd'hui  de  16  fo  ••  les  approches  necu3saires  sunt  en  cuurs  actuelleiaeut  puur  atte-mdre 
25 

Remarques  : 

1°)  Les  (ourbes  de  conduite  pour  chaque  .ode  seat  defines  en  function  de  la  temperature  et  de  l'alti¬ 
tude  1  partir  des  donnees  fuurnies  par  le  programme  le  performances  du  moteur.  On  prend  en  compte,  dans 
.ette  definition,  des  termes  additifs  aux  valeurs  thuoriques  du  parametre  de  c.ndaite  qui  correspondent  aux 
phenomena;:  suivants  :•  transitoires  de  regimes  en  particulier  lurs  de  1*  evolution  thermique  du  mjteur  ru  de- 
collage,  presence  d'humidit.  dans  l'atnosphere  reelle,  e'earts  entre  moteur  minimal  et  Eoteur  moyen  p.ur  les 
regimes  certifies. 

2°)  En  cas  de  panne  d'une  indication  de  parametre  de  conduite  (HI  ou  EPRJ ,  une  conduite  manuelle  e-st 
stilisee  en  secours  au  moyen  d'un  astro  parametre,  moyennant  guneralement  la  prise  en  compte  de  leg  res  pt- 
nalitis  de  poussee.  Le  parametre  de  remplacement  da  N1  est  le  152  pour  le  mottar  GE,  celui  de  l'EPR  tst  lu 
111  cour  le  moteur  PWA.  Les  objcctiis  fixes  pour  la  definition  d>-  ces  c.irbes  de  sec.urs  s  nt  les  su-vaiU  : 
.  6tr<  our  dt  la  ;  .joste  riellemer.t  obt>  ha-  sur  les  reacteur.,, 

.  cTru  sur  le  ue  t  as  dupa -s-r  lev  limitati  i,.  'lu  a, tear. 
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EPR  LIMITE 


FIGURE  2 

EXEMPLE  DE  COURBE  DE  CONDUITE  :  JT9D  -  DECOLLAGE 


Cette  theone  de  la  eonduite  moteur  est  mise  en  pratique  dans  le  manuel  de  vol  de  1' avion  qui  donne 
le  trace  des  differentes  courbes  dont  nous  avons  parle,  amsi  que  les  corrections  necessaires. 

Mais  ce  calcul  manuel  est  egalement  prevu  dans  le  systems  automatique  comprenant  le  calculateur  de  HI  ou 
EPR  limite  et  l'afficheur  correspondent.  Ce  calculateur  (CNL  ou  CEL),  de  technologie  digitale,  assure  les 
fonctions  suivantes  : 

.  calcul  du  N1  ou  EPR  limite  a  partir  des  parametres  de  vol  (altitude  -  pression,  mach,  temperature 
totale)  et  des  conditions  de  prelevements  d'air,  pour  les  diffcrents  modes.  Pour  cela,  le  calculateur 
possede  en  memoire  les  differentes  courbes  d'EGT  limite  sous  forme  de  polyn8mes,  ainsi  que  les  valeurs 
des  temperatures  de  cassure  ; 

.  calcul  de  la  TAT  a  partir  des  signaux  delivres  par  la  sonde  avion  et  comptc-tenu  des  diverses  correc¬ 
tions  a  leur  apporter  (etalonnage,  echauffement  pour  degivrage)  ;• 

.  elaboration  d'un  signal  d'erreur  entre  la  valeur  du  HI  ou  EPR  limite  et  les  valeurs  reelles  HI  ou  EPR 
des  moteuis  pour  utilisation  par  le  calculateur  d'automanette. 

L'afficheur  de  HI  ou  EPR  limite  ( AXIL  ou  AEL) ,  de  format  3x5  ATI  est  situo  sur  la  partie  centrale  de  la 
planche  de  bord  et  comprend  : 

.  Un  clavier  a  touches  lumineuses,-  chaque  touche  correspondent  a  un  mode  de  eonduite  :  TO,  FLX  TO,  GA, 
MCT,  CL,  CR.  Chaque  touche  comporte  deux  parties  :■  la  partie  mfeneure  affiche  en  permanence  ] 'ins¬ 
cription  du  mode  en  blunc  ;  la  partie  supeneure  est  constitute  par  un  voyant  qui  s'eclaire  quand  le 
mode  correspondant  a  ete  choisi  et  est  correctement  pns  en  cempte  dans  le  calcul  (voyant  vert  pour 
tous  les  modes  sauf  pour  le  FLX  TO  ou  il  est  ambre).  Il  y  a  egalement  une  touche  de  test. 

.  Un  ensemble  d'affichage  de  N1  ou  EPR  limite,  compose  de  quatre  afficheurs  lummeux  donnant  la  valeur 
du  parametre  limite  calcule.  Le  dernier  afficheur  correspond  a  0,1  %  RPM  N1  ou  0,001  EPR. 

.  Un  ensemble  d'affichage  de  la  TAT,  compose  de  deux  afficheurs  lummeux  du  mgme  type  que  le  prto'dent 
ainsi  qu’un  afficheur  supplementaire  pour  le  sigi  qui  mdique  la  temperature  totale  TAT  en  provenan¬ 
ce  de  la  sonde  avion  via  le  calculateur.  Le  dernier  afficheur  correspond  a  1°C. 

.  Un  clavier  de  roues  codeuses  permettant  d'afficher  manuellement  la  temperature  fictive  utilid'.-e  pour  ^ 
le  decollage  a  poussee  adapte'e  a  partir  des  donnees  de  la  ficht  de  terrain,  comma  cela  a  etc  explique 
preef demment . 

En  complement  au  systeme  automatique  de  calcul  du  M  ou  EPR  limite,  le  couplage  avec  le  systeme  auto- 
manette  a  etc  realise  sur  l'A300.  A  I'ungme,  l'autonanette  a  etc  conque  pour  le  mode  "UPEED",  e'est-a- 
dire  pour  l'obteution  ct  le  aamtien  d'une  vitesse  avion  donnec,  essentiellcat-nt  en  croioiero  et  pendant 
les  phases  d'attente  et  d'approche.  Par  la  suite,  cunpte-tenu  des  possibilities  du  calculateur  a 'uut  jeanette 
et  des  informations  utiiisables  iepuis  le  calculateu”  de  HI  eu  EPR  limite,  le  couplag.  entre  les  deux  cal- 
culateurs  a  uerr.is  de  dc'velopper  un  nouveau  Tode'  appelt  mode’  "HI"  ..u  "EPR".  Quand  celui-ci  est  utilis., 
1'aatomanette  assure  1  'asservissement  du  HI  cu  de  1'EPR  reel  des  moteurs  avec  le-  HI  .a  l'EPR  lj.ro.ti  .  Amsi , 
j.e  systeme  d'aut  .mar.ette-  a  pns  de  1' importance  puioqu'il  est  utilise'  soil  en  mode  "LI"  ou  "Ef'R",  o  it  en 
mode  "GPEED"  dar.s  toutes  leo  peases  de  vei  sauf  la  d*.  scei.te.  P.ur  mi'm.j.re,  nous  signaltmio  que-  -e  oyot'.me 
agit  sur  un  ceul  servenuteur,  chaque  re'actour  .'taut  "aim.'"  mde pundomr  .nt  ai  njyci.  d*  deux  embrayages- 


Pour  terminer  ce  paragraphe  our  les  calculateurs,  nous  parlerons  brievement  des  tests  du  calculateur 
N1  (EPR)  1  unite .  D'une  part,  ll  possede  une  autosurveillance  permanente  qui  est  particulierement  aisee 
grSoe  a  la  teehnologie  digitate  ;  amsi  97  CI°  des  circuits  sont  autotestes.  De  meme,  1 'autosurveillance 
couvre  divers  elements  exterieurs  :  regimes  et  EPR  des  moteurs,,  donnceo  en  provenance  de  la  centrale  anemo- 
metnque,  circuits  d'interface,  liaison  digitate  calculateur  -  afficheur,  etc-..  Les  defauts  ainsi  detec- 
tes  sont  mdiques  sur  la  face  avant  de  1' afficheur  et  envoyes  sur  le  message  digital  vers  les  utilioateur3. 
Par  ailleurs,  le  bouton  poussoir  de  test  situe  sur  la  face  avant  de  1 'afficheur  Nl/EPR  limitc  permet  d'ef- 
fectuer  des  tests  cumplementaireo  dunt  les  resultats  sont  transmis  vers  les  fenetres  Nl/EPR  limite  et  TAT  : 
la  presence  de  six  "8"  muntre  1;  bon  fo.ictiomement  de  l'ensembie,  d'autres  configurations  d'affichages 
permettent  de  localiser  en  grande  partie  l'ongine  de  le  panne  :  ADC,  sor.de  TAT,  ANL/aEL,  liaisons,  etc... 

La  figure  3  dor.ne  un  schema  recapitulatif  scmmaire  de  l'ensembie  des  systemes  decnts,  schema  qui 


CF6-50  -  SCHEMA  D' ENSEMBLE  DU  SYSTEME  N1  LIMITE 


Pour  terminer  ce  cnapitre  consacru  a  l'A  300,  nous  parlerons  de  l'utilication  des  systemes  de  conduite 
moteurs  que  nous  venous  de  voir,  laquelle  peut  so  decomposer  on  trois  mudes  :■ 

..  mode  manuel 

.■  mode  automatique  shns  automanette 
.  mode  automatique  avec  automanette. 

1°)  Le  mode  manuel  est  celui  qui  est  le  moms  utilise  ;  il  constitue  le  secours  du  calculateur  de  pous 
see  limite  en  cas  de  panr.e  de  ceiui-ci.  Dans  ce  cas,  le  pilote  lit  sur  les  courbes  de  conduite  donnees  dans 
le  manuel  de  vol  la  valeur  du  N1  ou  EPR  limite  en  function  du  mode  de  conduite,  do  la  TAT,  de  1 'altitude  et 
de  la  Vitesse  avion.  Il  peut  effectuer  les  corrections  dues  aux  prelevements  d'air  et  utilisor  la  metis  de  do 
la  temperature  fictive  pour  les  decullages  a  poussee  adap.'e.  Ayant  determine  la  valeur  du  parametre  limite, 
lc  pilote  affiche  cette  valeur  sur  les  index  des  mdicateurs  HI  uu  EPR  eomme  cela  a  ite  indique  preci'demr.ont 
puis  pousse  les  manettes  de  gaz  jusqu'a  la  coincidence  des  valeurs  reelles  avec  les  valeurs  limites.  Les  in¬ 
dications  digitales  permettent  d'obtenir  la  precision  requise. 

2°)  Le  node  automatique  sans  automanette  permet  au  pilote  d'eviter  la  partie  calcul  et  affichage  du  pa 
rametre  limite,  laquelle  est  prise  en  cunpte  par  le  .alcuLatuur  Nl/EPR  limits  lorsque  le  mode  a  et>'  silict 
sur  la  touche  currespondante-  En  1' absence  de  selucti  a,  1 'alimentation  eleetnque  etant  etablie,  le  type  du 
moteur  pour  lequel  les  courbes  de  conduite  sont  memonstes  dans  le  calculateur  est  mdique  dans  Is  fenStre 
Nl/EPR  linite. 

3°)  Le  node  ant  unatique  avec  automanette  permet  d'alloger  au  maximum  la  tSche  du  pilote.  Api’s  avoir 
selects?  le  mode  de  conduite,  puis  le  mode  "HI"  ou  "EPR"  sur  le  pannoau  automanette,  1' engagement  du  systems 
assure  un  for.ctionnement  entierement  automatique,  pour  lequel  le  pilote  n'a  plus  qu'a  verifier  le  bon  func- 
tionnement  au  moyer.  de  tous  le3  affichages  di’„a  signalis.  En  cas  de  p-.n-.o  d'un  element  quel.'n.qae,  1 'auto¬ 
manette  est  a.t  .matiquemy.nt  d-'connect/u.  Par  ailleurs,  pour  certames  pi.ases  de  v  1  (attest'  ,  appr:che), 

1  „  pilut*j  o^lcctt-ra  de  preference  lc  ::ud‘j  "SPEED"  qui,  lui,  assurers  1~  naintitn*  automatique  de  la  viteSoL 
•b  I’avi'ji**  Dane  oj  cas,  le  param»»trt  lunate  ect  t  >uj  >ui\3  er  dans  la  b.ucle  d’assoi’vi. sclent  vt  is*  rt 

de  but  'u  au  calcul • 
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3  -  EVOLUTIONS  ENVISAGEES  POUR  L' AIRBUS  A  310 

L'A  310  qui  est  une  version  legerement  raccourcxe  de  l'A  300,  doit  effectuer  son  premier  vol  au  de¬ 
but  de  l'annee  1982.  Il  sera  equine  comme  l'A  300  de  deux  families  de  moteurs  : 

-  famille  JT9B  (17R4C)  de  PRATT  &  WHITNEY 

-  famille  CE6-80  (A1 )  de  GENERAL  ELECTRIC. 

Ces  deux  moteurs  sont  tres  voisins  de  ceux  mstalles  actuellement  sur  l'A  300,  au  niveau  de  poussee  pres. 

Be  plus,  ils  beneficient  de  differentes  ameliorations  techniques  etudiees  par  leur  fabncant,  et  en  par¬ 
ticular  un  systeme  de  regulation  plus  elabore  que  l'actuel  par  1' introduction  de  1 1 electronique  sur  le 
moteur  lui-meme.  C'est  1' integration  a  1' avion  de  ces  nouveaux  systemes  que  1 ' AEROSPATIALE  etudie  actuel- 
lement  en  liaison  etro: te  avec  GE  et  avec  PWA,  afin  de  proposer  une  option  conduite  moteurs  amelioree  aux 
compagnies  aenennes.  Le  present  chapitre  sera  done  base  surl'etat  de  l'etude  tel  qu'il  est  connu  ac- 
tuel.1  ement,  en  juillet  1979-  Nous  nous  interesserons  successivement  aux  points  suivants  :  problemes  poses 
par  le  systeme  actuel  de  l'A  300,  solutions  proposees  par  les  motonstes,  adaptation  de  ces  solutions  -u 
systeme  avion,  procedures  d' utilisation  qui  en  decoulent,  avantages  que  l'on  peut  attendre  de  telles  evo¬ 
lutions- 

Le  systeme  de  conduite  tel  qu'il  est  defmi  actuellement  pour  les  moteurs  GE  ou  PWA  mstalles  sur 
I'AIRBUS  A  300,  amene  quelques  petits  problemes,  lesquels  sont  pratiquement  compenses,  du  point  de  vue 
opera tionnel,  par  le  couplage  realise  entre  le  calculateur  de  poussee  et  i'automanette. 

Le  premier  de  ces  problemes  resulte  du  risque  de  depassoment  des  limitations  moteurs  (regimes,  tem¬ 
perature  EGT)  qui  accompagne  les  mouvements  intempestifs  des  manettes  des  gaz,  en  particulier  dans  la  zone 
des  pJeines  pouasees  :  decollage  et  remise  des  gaz.  Ce  risque  est  particulierement  important  lors  de  l'af- 
fichage  du  N1  ou  de  l'EPR  en  mode  mar.uel.  En  effet,  la  valeur  limite  du  parametre  de  conduite  aoit  gtre 
atteinte  rapideuient  de  fagon  a  assurer  l'obtention  de  la  poussee  necessaire  le  plus  tfit  possible  pendant 
la  phase  de  decollage  ou  de  remise  des  gaz  ;  cette  manoeuvre  mar.uelle  rapide  est  difficilement  compatible 
avec  le  fait  qu'il  faut  prendre  des  precautions  pour  eviter  tout  depassement  de  la  valeur  limite.  Nous  ne 
citerons  que  pour  menoire  le  positionnement  accidentel  des  manettes  de  gaz  a  la  pleine  butee  avant,  dont 
les  consequences  son+  d'autant  plus  importantes  que  la  temperature  ambiante  est  faible.  Ces  nsques  exis¬ 
tent  done  avec  une  procedure  manuelle..  Ils  existent  aussi,  mais  avec  une  probability  beaucoup  plus  faible 
en  mode  automatique  pjur  certains  cas  de  panne  du  systeme  calculateur  de  poussee  -  automanette. 

Le  deuxiame  probleme  rencontre  dans  la  conduite  des  moteurs  de  l'A  300  est  le  phenomene  d' evolutions 
transitoires  du  parametre  de  conduite  durant  la  phase  de  decollage.  Il  est  dd,  d'une  part  a  la  variation 
des  jeux  entre  rotors  et  stators  du  moteur  lors  de  la  raise  en  temperature  de  celui-ci,  et  d' autre  part  a 
1' effet  de  la  Vitesse  de  1' avion  sur  la  thermodynamique  interne  du  reacteur.  Ces  deux  effets  provoquent 
generalement ,  a  partir  du  moment  ou  la  manette  de  gaz  est  fixe,  une  chute  assez  sensible  du  N1  ou  de  l'EPR 
durant  une  minute  environ,,  suivie  d'une  lente  remontee  vers  la  valeur  initials.  Cette  chute  du  parametre 
de  conduite  done  de  la  poussee,  doit  §tre  prise  en  oornpte  dans  la  definition  de  la  conduite  par  une  majora- 
t±on  suffisante  de  ce  parametre  par  rapport  a  la  valeur  theonque,  d'ou  une  reduction  de  la  marge  d'EGT 
par  rapport  a  ce  qu'elle  pourrait  etre  en  1 'absence  de  ces  phenomenes. 

En  plus  de  cette  reduction  de  la  marge  EGT,  les  regulations  des  moteurs  sont  telles  que  le  decollage 
s'accompagr.e  toujours  d'une  pomte  plus  ou  moins  prononcee  de  cette  temperature.  Il  en  resulte  une  accele¬ 
ration  de  l'usure  du  moteur,, 

Enfin,  le  dernier  probleme  qu'entraine  la  regulation  hydromecamque  est  sensible  d„  point  de  vue 
operationnel  ;  il  s'agit  de  la  variation  de  la  position  manette  des  gaz  pour  un  regime  N1  ou  un  EPR  donne 
en  fonction  de  la  temperature  ambiante.  Cette  variation  qui  peut  §tre  de  l'ordre  de  30°  TLA  pour  le  moteur 
GE  est  cchematisee  par  la  figure  4  pour  le  noteur  PWA.  Il  en  resulte  une  variation  tres  grande,  selon  la 
temperature,  de  la  sensibilite  de  la  manette  dans  la  plage  regime  ratenti  -  regime  maximum  decollage.  Be 
plus,,  le  fait  que  1 'angle  TLA  ne  soit  pas  directement  dans  la  boucle  de  regulation  du  parametre  de  con¬ 
duite,  compte-tonu  des  jeux  et  des  tolerances  sur  les  reglages  de  la  commande  mecamque  des  gaz,  entraine 
de  legers  decalages  entre  les  deux  manettes  sur  un  meme  avion.  Ces  differents  problemes  relatifs  a  la 
manette  des  gaz  doivent  dtre  pns  en  compte  par  le  pilote  lorsqu’il  assure  une  conduite  manuelle.  Ils  ont 
egalement  etc  consideres  pour  la  definition  du  systeme  d 'automanette. 


THROTTLE  LEVER  POSITION 
POSITION  MANETTE  DES  GAZ 


FIGURE  4 

ii'i  Piter. 00/... 3  Q.o  i)L  ■/  T  ‘D  —  —ni.oIBJLirp  1  .A* . i. I1 i 


15-8 


I 


¥ 


i 

£ 


i 

I 


Remarque  : 

Comme  nous  I'avons  deja  indique,  les  critiques  ainsi  faites  au  systeme  tel  qu'il  existe  sur  A  300 
sont  tres  attenuees  du  fait  de  la  presence  de  1'automanette  utilisee  en  mode  N1  ou  EPR  ;  elles  re- 
prendraient  leur  importance  pour  un  avion  ne  comportant  pas  ce  perfectionnement. 

Afin  de  pallier  ces  inconvenients,  les  deux  motonstes  GE  et  PWA  ont  propose,  pour  les  nouveaux  mo- 
teurs  devant  equiper  l'A  310,  une  amelioration  importante  par  l'adjonction  d'un  regulateur  electronique. 
installe  sur  le  moteur  lui-m§me,  qui  agit  sur  le  regulateur  hydromecanique.  Bien  que  les  definitions  pre¬ 
sentees  a  l'ongine  par  GE  et  par  PWA  soient  legerement  differentes,  nous  nous  baserons  sur  un<  defini¬ 
tion  pratiquement  commune  vers  laquelle  les  deux  motoristes  devraient  tendre  a  la  demande  de  'avionneur. 

Le  regulateur  electronique  que  nous  designerons  par  le  symbole  EC  est  un  calculateur  d’gital,  ins¬ 
talle  sur  le  carter  de  soufflante  du  moteur,  qui  reqoit  des  signaux  en  provenance  du  reacteur  et  de  1 'avion 
regime  HI  ou  EPR,  pression  et  temperature  a  la  face  d'er.tree  du  moteur,  position  manette  de  gaz,  ncmbre  de 
mach,  altitude-pression,  mode  de  conduite  et  signaux  associes.  La  figure  5  montre  le  schema  du  systeme  de 
regulation  du  JT9D. 


TT2  MACH 

FIGURE  5 

SX3TEHE  DE  REGULATION  ELECTRONIQUE  DU  JT9D 


Le  HMC  fonctionne  toujours  en  regulation  du  regime  N2  par  dosage  carburant.  Le  EC  envoie  deux  sortes 
de  signaux.  D'une  part,  il  agit  sur  un  moteur-couple  ajoute  au  regulateur  hydromecanique,  qui  modifie  les 
lois  de  regulation  a  l'mterieur  d'une  plage  d'autorite  physiquement  limitee.  La  representation  de  1'inter- 
action  EC/HMC  sous  la  forme  de  la  poussee  en  fonction  de  1 'angle  manette  au  poste  est  donnee  figure  6  pour 
le  JT9D.  On  voit  que  la  position  "pleme  poussee  avant"  de  la  manette  donne  la  poussee  necessaire  au  docol- 
lage  sans  depassement,  grfice  a  l'acnon  du  EC.  D'autre  part,  le  regulateur  electronique  envoie  vers  le  sys¬ 
teme  avion  Ids  valeurs  qu’il  convient  de  connaitre  pour  assurer  l'affichage  et  l'ubtention  du  parametre  de 
conduite . 

Le  EC,  qui  possede  sa  propre  alimentation  electnque  pai  un  alternateur  special,  assure  son  auto- 
surveillance  et  fournit  les  signaux  de  panne  curre-spondants,  a  la  fois  pour  les  systemes  avion  ot  pour  le 
HMC  qui,  automatiquement,  fixe-  le  signal  provenant  du  EC  a  sa  derniere  valour  avant  la  panne.  L'action  ul- 
teneure  du  pilote,  qui  n'a  pas  a  etre  immediate  du  fait  de  la  presence  do  la  logique  dent  nous  Vonons  de 
parler,  est  de  deconuecter  le  E.C.  aim  de  redonuer  sa  pleine  entente  a  la  regulation  hydromecanique,  et 
de  surveiiler  le  moteur  /u-a-vio  des  limites. 

La  presence  du  regulateur  electronique  assure  une  neilleure  protection  du  moteur  durant  les  transi- 
toires  et  centre  les  manoeuvres  mtempestives  de  munettes.  11  amolicre  la  sensibilito  de  la  manette  des 
gaz  puisque  le  ralenti  et  la  pleine  poussee  sont  jbtenus  pour  des  positions  fixes  sitm'es  aux  deux  extremes 
de  la  course  du  levier,  comme  cela  est  montre  figure  7.  Nous  reviendrons  ultez leurement  sur  les  avantages 
apportes  par  ce  nouveau  systeme. 
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FIGURE  6 


FULL  FORWARD 
PLEINE  POUSSEE  AV 


INTERACTION  REGULATIONS  ELECTRDNIQUE/HXDROMECANIQUE 


HYDROMECHANICAL  CONTROL 
REGULATION  HYDROMECANIQUE 


ELECTRONIC  CONTROL 
REGULATION  ELECTRONIQUE 


COLD  DAY 
JOUR  FROID 


HOT  DAY 
JOUR  CHAUD 


TAKEOFF 

DECOLLAGE 


CLIMB 

MONTEE 


-TAKE-OFF  — 
DECOLLAGE 


THROTTLE  LEVER  POSITION 
POSITION  MANETTE  DES  GAZ 


THROTTLE  LEVER  POSITION 
POSITION  MANETTE  DES  GAZ 


FIGURE  7 

REGULATIONS  HYDROMACANIQUE  ST  ELECTRONIQUE  -  SS1ISI BILITES  MANETTE 
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Hous  allons  mamtenant  examiner  les  repercussions  sur  1' avion  de  la  presence  de  cette  nouvelle  regu¬ 
lation  moteur.  Le  systeme  de  contffile  de  poussee  de  l'A  310  comprend  les  elements  principaux  suivants  : 

-  un  regulateur  de  poussee  TCC 

-  un  afficheur  de  poussee  TRP 

-  deux  regulateur  electroniques  EC,  pour  moteur  1  et  moteur  2 

-  deux  regulateurs  hydromecaniques  HMC,  pour  moteur  1  et  moteur  2 

-  deux  indicateurs  N1  ou  EPR,  pour  mrleui  1  et  moteur  2. 

Les  cri teres  de  base  consideres  pour  1 ' integration  avi,n  sont  les  suivants  : 

.  Le  regulateur  hydromecanique  assure  toujours  la  regulation  prmcipale. 

.  Le  regulateur  electronique  est  utilise  pour  la  conduite  moteur  (calcul  du  parametre  limite)  pour  tous 
les  modes. 

.  Pour  le  mode  decollage  a  poussee  maximale,  les  manettes  des  gaz  sont  amenees  manuellement  ou  automati- 
quement  jusqu'a  la  butee  pleine  poussee  avant. 

.  Pour  le  mode  decollage  a  poussee  adaptee,  les  manettes  des  gaz  sont  amenees  manuellement  ou  autumatique- 
ment  a  la  position  dormant  la  valeur  necessaire  du  parametre  limite  ;  cette  position  est  en  retrait  par 
rapport  a  la  butee., 

.  Les  deux  modes  maximum  decollage  et  remise  des  gaz  sont  confondus  du  fait  de  la  pri3t  en  compte  par  le 
EC  de  1 'altitude  pression,  de  la  temperature  et  du  nombre  de  mach. 

.  Le  EC  agit  sur  les  lois  contenues  dans  le  HMO,.  a  l'inteneur  d'une  plage  d'autonte  limitee. 

•  Le  but  de  l'aviormeur  est  d'aboutir  a  des  definitions  tres  voismes  pour  les  deux  families  e'e  moteur  GE 
et  PVA. 

La  figure  8  donne  le  schema  de  l1 ensemble  du  systeme  avion. 


A  310  -  SYSTEME  DE  REGULATION  DE  POUSSEE  AVEC  REGULATEUR  ELECTRONIQUE 


Les  fonctions  des  principaux  equipements  du  systeme  sont  assurces  comme  suit  : 

1°)  Le  TCC  contrGle  les  modes  maintien  de  vitesse  avion  et  N1  ou  EPR.  Ii  effoctue  les  comparaisons 
necessaxres  entre  les  deux  regulateurs  eltctroniques  et  les  .  centrales  anemometriques. 

2°)  Le  TRP  assure  l'affichage  du  parametre  limite  (valeur  maximale  des  deux  EC)  et  de  la  temperature 
totale  ;•  ii  permet  la  selection  du  mode  de  conduite  et  de  la  temperature  fictive  pour  le  FLX  TO  :  il  si- 
gnale  les  pannes  SC  et  permet  leur  deconnexion,  il  assure  la  logiquu  des  prelevements  d'air  moteur  pour  le 
calcul  des  corrections  correspondantes  dans  les  EC. 

3°)  Les  EC  calculent  les  N1  ou  EPR  de  conduite  pour  tous  les  modes  ;  lls  ferment  les  boucles  de  regu¬ 
lation  moteur  ;  ils  assure"*-  la  transmission  des  principaux  paranetre3  sous  forme  digitale. 

4°)  Les  indicateurs  K1  ou  EPR  affichent  les  parametres  de  conduit"  : 

•  N!  ou  EPR  reel  sur  une  aiguille  et  sur  un  repv  iteur  digital  a  qua t re  tambours, 

.  HI  ou  EPR  limits  sur  un  index  penphenque, 

.  HI  ou  EPR  dit  "de  commande"  sur  une  deuxiome  aiguille  ;  cette  valeur  est  la  transcription  en  HI 
ou  en  EPR  du  TLA,  elle  suit  done  sans  aucun  retard  toute  variation  meme  rapide  de  la  rcanett"  des 
gaz. 
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Le  fonctionnement  general  du  systeme  est  le  suivant.  Selon  le  mode  de  conduite  selecte  sur  le  TRP,  le 
regulateur  eleetr<  mque  calcule  et  transmet  pour  affichage  la  valeur  du  parametre  limite  ;  la  poussee  est 
obtenue  par  deplacement  maruel  ou  automatique  de  la  manette  des  gaz  de  faijon  a  egaler  1 'indication  de  com- 
mande  (HI  de  commando,  ou  EPR  de  commande)  avec  la  valeur  limite.  Comme  nous  l'avons  deja  indique,  le  ma¬ 
ximum  decollage  est  obtenu  avec  la  manette  e.n  butee,  les  autres  modes  par  des  positions  l.itermediaires  mais 
restant  chacune  a  l'mteneur  d'une  plage  trls  reduite.  Les  regulateuT-0  eieccronique  puis  hydromecanxque 
referment  la  boucle  d'asservissement  en  egalant  le  parametre  reel  du  moteur  au  parametre  de  commande  et  par 
consequent  au  parametre  limite-  La  schematisation  de  la  boucle  de  regulation  entre  le  TCC,  le  TLA  et  le  EC 
au  royen  du  H1  ou  SPR  de  commande  et  du  HI  ou  SPR  limite,  est  presentee  figure  9- 


A  310  -  REGULATION  AUTOMATIQUE  DE  LA  POSITION  DE  LA  MANETTE  DES  GAZ 


L'enchatnomont  des  operations  a  effectuer  par  le  pilote  pour  un  decollage  a  poussee  adaptee  par  exem- 
ple,  en  mode  automatique,  eat  done  le  suivant  (cf.  figure  8)  : 

1°)  Bouton  poussoir  de  mise  en  service  du  EC  sur  Ja  position  "ON"  (position  normale) 

2°)  "FLX  TO"  selecte  sur  la  touche  correspondante  du  TRP 
3°)  Temperature  fictive  choisie  affichee  sur  le  TRP 
4°)  Mode  N1  ou  EPK  selecte  sur  le  panneau  automanette 
5°)  Enclenchement  de  1' automane tte 

6°)  Entre  60  ct  80  kts  de  Vitesse  avion,  verification  qi  e  111  ou  EPR  reel  =  HI  ou  EPR  commande  =  III  ou  EPR 

limite . 

Cette  procedure  est  voisme  mais  plus  simple  poui  '  es  autres  modes  de  conduite. 

Dans  1 ' eventuality  d'une  panne  de  J'un  des  deux  regiuatcurs  electroniques,  un  voyant  lumineux  "FAULT" 
s'eclaire  sur  le  TRP,  alarme  qui  est  in  ogree  dans  un  bouton  poussoir  servant  a  la  mis e  en  iu  hors  fonc- 
tionnement  des  deux  EC.,  La  position  "Oj  1 "  de  oe  bouton  poussoir  permet  au  pilote,  sur  une  panne  d'un  regu- 
latcur  electronique,  do  deconnecter  part  1  ieme.it  les  deux  regulateurs  en  ce  qui  concerne  leur  action  sur 
les  regulateurs  hydromecaniques,  oeci  afin  de  co..„o’*ver  la  syru'tne  des  deux  moteurs  et  de  continuer  a 
utiliser  I1 automanette.  Dane  ce  cas,  le  EC  ne  s’etant  pas  declare  en  panne  assure  le  caloul  du  N1  ou  EPR 
limite.  et  l1 automanette  asservit  le  N1  ou  l’EPR  reel  sur  ce  N1  oe  EPR  limite. 

Pour  resumer  loe  differentes  configurations  opcrationnelles  pouvaut  so  presenter  en  mode  Nt  ou  EPR, 
nous  dresseron3  le  tableau  suivant  : 

a)  Fonctionnement  normal  sans  par.ne 

-  Le  TRP  affiche  la  plus  grande  des  deux  valeurs  du  parametre  de  conduite  veuaet,  des  deux  EC,  a  condi¬ 
tion  que  i'ecart  entre  ces  deux  valeurs  soit  inferieur  a  une  limite  donnee. 

-  Les  manettes  sont  asservies  par  comparaison  entre  Nt  ou  EPR  de  commande  et  N1  ou  EPR  limite. 

b)  Panne  de  un  EC 

-  Le  TRP  affiche  la  valour  du  parametre  limite  venant  du  EC  en  bon  fonctionnement. 

-  Les  manettes  sont  asservies  par  comparaison  entre  HI  ou  EPR  reel  des  moteurs  et  HI  ou  EPR  limite. 
o)  Panne  du  TRP 

-  Le  TRP  affiche  un  dr.-.v"au  d' alarme- 

-  Los  manettes  sont  amtr/es  luaruellement  a  la  position  donnant  le  parametre  limite  lu  sur  les  oourbes 
du  manuel  dt  vol 

d)  Ranne  du  TCC 

-  Le  TRP  afficLo  la  plus  grande  dos  deux  valours  du  parametre  de  conduite  comme  en  fonctionnement  normal. 

-  Les  mam  ttes  sont  amenceo  manuollement  a  la  position  donnant  le  parametre  limite  afficne  sur  le  TRP. 

Nous  signalerons  brievomont  la  presence  d'un  systbme  de  gestion  de  vol  (Flight  Management  System),  qui 
nermet  d'  ptiruour  le  vol  sur  certains  entires  particulicrs,  par  exemple  cuusommatinn  carburant  mini  male, 
Uir*'c  de  vel  latumale*,  etc...  Quail  Ct  systeme  est  en  functi onm-mtut,  les  index  pt'npheriques  des  u.dica- 
teurs  HI  .u  EPR  sont  commandos  n  :r  plus  par  les  ..ignaux  de  parametre  limite,  mais  par  les  signaux  en  prove- 

i.ance  uu  calcxlatour  de  gcsti.u.  dt  Vol  que  I’on  appelle  HI  but  ju  GPR  but.  Lc  pilote  manuollement  ou  le  TCC 

automat’ quoment  amine  1".,  manettes  ue  jap  a  la  position  donnant  legalisation  du  I<1  ou  du  EPR  de  commande 
avec  ct  paramltre  u:*.  Dans  c.  mode  do  fonetionuemu.t,  It  HI  ou  SPR  linutt  est  Ktmonst  dans  les  calcula¬ 
tors  et  sert  oc  protection  vis-a-vis  dt  ic'passer.ents  tVontucis. 

I1  ns  ii'u  sisttrcr.s  pas  davantagt  dans  ce  d^"ui.er.t  sur  la  .  urvt  illarct  de  *;cs  synt-’me.,  dt  rtgulaii:..  dt 
p  jow'._.  Cnaqu*.  calcalattui’  asoUft  ~  n  a  it: -curve  ilianc*  .  En  c  mpl-'ment,  ui.  test  mtc'grt  utilisacc*  a.  sol 
tt  .i.  v.l  poscitlt  a  partir  a’v.  o'.t.u  ptusom-  si  cue  e.<r  la  fact  avant  an  T'’r.  Il  ptrmet  de  d*'ttot-.r 

tt  d' ilcntifi.tr  '<r. t  grande  pa 'lie  d*  s  panno  3  pouvant  Lnaj  p*  r  aux  difff'rentes  autt-surv^illancf s . 


15-12 


Les  avantages  qu'apportent  le  regulateur  electronique  et  son  integration  a  l'avion  telle  qu'elle  a 
cte  etudiee  peuvent  gtre  consideres  de  trois  points  de  vue  : 

.  les  avantages  concemant  le  fonctionnement  du  moteur  proprement  dit, 

.•  les  avantages  obtenus  pour  la  definition  du  3ysteme  avion, 

.  les  avantages  opera tionnels. 

Concernant  le  reacteur  CF6-80,  le  nouveau  systeme  apporte  une  reduction  des  nsques  de  depassements 
des  limitations  puisque  la  position  manette  en  butee  avant  est  la  position  r.crmale  du  maximum  decollage. 

II  permet  d'eliminer  les  transitoires  de  legime  HI  durant  la  phase  de  decollage  ;  en  effet,  le  regulateur 
electronique,  disposant  des  signaux  de  temperature  e+  pression  entree  moteur  ainsi  que  du  macb,  peut  as¬ 
surer  le  maintien  du  regime  exactement  h.  la  valeur  determinee.  Il  en  resulte  une  diminution  de  1' importan¬ 
ce  de  la  pointe  d'EGT  qui  survient  au  cours  du  decollage  et  par  consequent  un  gain  sur  la  marge  d'EGT.  GE 
a  estime  qu'il  peut  ainsi  gagner  8‘  0  sur  cette  marge  EGT,  valeur  qu'il  traduit  en  un  gam  de  1 7C0  heures 
sur  la  duree  de  fonct: '  nement  du  moteur. 

Le  reacteur  JT9D  beneficie  des  mdraes  avantages  que  ceux  que  nous  venons  d'indiquer  pour  le  reacteur 
GE.  En  complement,  le  regulateur  electronique  peut  assurer  par  la  prise  en  compte  directe  de  l'EGT,  une 
surveillance  de  cette  derniere,  et  done  une  meilleure  protection  vis-a-vis  de  la  limitation  corrospondante . 

Du  point  de  vue  de  la  definition  du  systeme  avion,  la  presence  du  EC  permet  de  simplifier  partielle- 
me.it  le  calculateur  de  poussee  TCC,  du  fait  q^e  le  caloul  du  parametre  de  conduite  est  assure  pour  tous 
les  modes  par  le  EC.  La  mise  en  oeuvre  du  systeme  d' acquisition  et  d'enregistrement  des  parametres  de  l'a¬ 
vion  est  amelioree,.  etant  donnt  que  le  regulateur  electronique  fournit  ur.  certain  nombre  de  parametres 
reacteur  sur  une  sortie  digitale  ARINC  429.  Infin,  la  presence  de  deux  EC  pour  l'avion  assure  une  redon- 
ince  meilleure  que  ce  qu'elle  n'est  ac*uellement  sur  A  300  :  en  cas  de  panne  d'un  EC,  le  EC  restant  en 
fonctionnement  calcule  et  permet  d'afficher  1c  parametre  de  conduite.  Par  ailleurs,  le  regulateur  electro¬ 
nique  apperte  un  avantage  supplementaire  pour  le  moteur  PWA  en  ce  qui  concerne  la  chaine  de  mesure  de 
l'EPR.  En  effet,  1' installation  actuelle  du  JT9D  sur  l'A  300  comprend  pour  „haque  moteur,  deux  capteuro  de 
pressions  (PT2  et  PT7),  deux  transmetteurs  de  pressions,  et  un  boilier  electronique  d'elaboration  de  l'EPR 
pour  envoi  du  signal  vers  I'mdicateur  au  poste  de  pilotage  ;  la  presence  du  EC  suppnme  tous  ces  elements 
du  fa- 1  que  le  regulateur  lui-mdmo  fournit  d?.rectement  en  sortie  digitale  la  pression  PT2,  la  press-’ on  PT7, 
et  le  rapport  EPR, 

Operationnellement,  le  nouveau  systeme  apporte  quelques  avantages  qui  sont  surtout  sensibles  en  mode 
manuel  ;  obtention  de  la  poussee  pour  le  maximum  decollage  et  la  remise  des  gaz  on  positionnant  les  ma- 
nettes  on  butee  sans  preoccupations  de  risques  de  depassements,  reglage  plus  aise  gr&ce  a  la  presence  de 
I'mdication  supplementaire  EPR  ou  HI  de  commando.  Le  EC  permet  egalement  d'ameliorer  la  sensibilite  de 
la  munotte,  la  plage  complete  de  debattement  etant  toujours  utilisee  entre  le  ralenti  et  le  maximum  decol¬ 
lage  quelles  que  soient  les  conditions  ambiantes.  Cet  avantage  s'accompagne  d'une  diminution  sensible  du 
decaiage  entre  les  deux  manettes.  Le  dernier  avantage  operatic  ?1  oonsiste,  en  cas  de  panne  ."tuple  de  un 
EC,  et  apres  deconnexion  par  le  pilote  des  liaisons  des  deux  *vcc  les  regulateurs  hydromocaniques,  a  la 
possibility  de  reutiliser  1  'automanette  a  partir  des  informations  en  provenance  du  EC  re-stant  en  bon  fonc- 
tionnement. 


4  -  CONCLUSIONS 

a)  Dans  cet  expose,,  novo  avons  tout  d'abord  examir"'  bnevement  les  donnees  du  probleme  general  de  la 
conduite  d<.s  moteurs  d'avions  civils-  L'objectif  principal  a  nttemdre  est  l'obtention  de  la  poussee  aveo 
un  maxi num  de  precision  tout  en  respectant  les  marges  impas  -s  vis-a-vis  des  limitations  du  reacteur.  Les 
autres  objectifs  a  satisfaxre  sont  la  simplicity  d'utilisat*...  et  la  reduction  de  la  consommation  specifi- 
que  et  des  codts  de  maintenance. 

Ces  objectifs  sont  attemts  au  moyen  de  differe.nts  systeraes  qui  peuvent  6tre  manuels  (commando  mo— 
canique  des  gaz,  regulation  hydroim'canique,  courbeo  de  conduite)  ou  automatiques  (calculateur  de  poussee 
limite,  automanette  et  couplage  des  deux) • 

b)  Nous  avons  ansuite  presents  la  constitution,  le  fonctionnement  et  1 'utilisation  des  systemes  ac- 
tuellement  matalles  sur  1' AIRBUS  A  300,  qu'il  soit  equine  de  reacteurs  GE  CP6-50  ou  PWA  JT9D  :■  commande 
des  gaz,.  lVgulateur  hydromecanique,  instrumentation  pnncipalo,.  courbc-s  de  conduite,  calculateur  de  N1  li¬ 
mits*  ou  EPR  Iitite,  calo*ulateur  d'autemanette.  On  aboutit  ainsi  a  ti-ois  modes  d'utilisation  :  manual,  auto- 
matique  sans  automanette,  automatique  avec  automanette,  les  deux  dormers  seulemetu  eorrespondant  a  des 
configurations  normales. 

c)  La  definition  des  cysteines  de  l'A  300  <>ant  acauise,  r.ous  avor.s  enumere  les  differents  probl\mes 
peSco  par  ceux-ci  qui  sont  lies  essentieileraent  au  pnncipe  mer.e  de  la  regulation  hydromecanique,  laquel- 
le  ne  tient  pas  compte  des  variations  de  conditions  ambiantes.  Ces  problemes  sont  les  suivants  :  risques 
de  depassements  mtempe-tifs,.  phen.menes  transitoires  durant  le  decollage,  variations  importar.tc-s  de  la 
jensibilite  nanstte  t ntrainant  des  dec' lages  entre  les  manettes  d'un  meme  avion  ou  d'un  avion  a  l'autre. 

Coiinaisoant  ces  imperfections  de  la  regu'atun  hydromecanique,  nous  avons  preseilte  les  solutions 
pi’oposees  par  les  moturistes  (adjoi.o’tion  d'un  regulateur  i-lectromque  affmant,  dans  cer tames  limites,  les 
lois  de  regUi.  cions  basiques  de  1 'hydromecanique)  et  leurs  repercussions  sur  la  definition  de  l'avun  A  3'U. 
P~ur  cela,  nous  nous  sommes  bases  sur  deux  pnncipaux  on  teres  :  le  regulateur  electronique  du  moteur  assure 
le  caloul  de  tous  les  modes  de-  conduite  (N1/SPR  limits,),  les  dt  collages  a  poussee  maximalt-  sont  effeotues 
avec  les  manettes  en  but*5e  avant. 

Les  avantages  appertes  par  un  te1  systeme  convenient  la  piotc  tun  du  moteur  lui-mene,  la  definition 
du  systeme  avion  et  1 'utilisation  par  le  pilots. 

d)  En  conclusion,  nous  pensons  que  le  systeme  du  type  install-'  sur  A  3C0  satislait  ple-inement  les  objec¬ 
tify  recherchec  et  penset  une  utilisation  i  p-'rationnelle  aisee,  les  ir.perfecti.es  inhc'rentes  a  ce  genre  de 
r-'gala**'.n  etant  p=r ciellement  cor.pensees  par  la  definition  du  systeme  avion  Les  ameliorations  apportees 
par  I'mtr.duetion  de  1'electror.iqu  sur  les  moteurs  de  2  ' A  310  assurent  une  meilleure  protection  du  moteur. 
facilitent  la  t5c*ie  de  I'avmun-ar,  cais  n'app.rtent  pas  d ' avantages  substantiels  du  point  de  vue  operation- 
nel  par  rappor.  au  syoteme  o.ascique  avec  aut.manett-  en  mode  ei.tierenent  aut. manque. 
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DISCUSSION 


M.J.Joby,  UK 

Figure  8  shows  engine  control  one  (EC1 )  receiving  inputs  from  ADC1 .  Would  system  integrity  be  increased  if  the 
inputs  from  ADC2  were  also  available  to  EC1 ,  or  is  this  provided  in  practice? 

Authoi's  Reply 

In  Figure  8,  the  TCC  compares  data  from  both  ADC1  and  2,  and  then,  in  normal  operation,  the  data  from  ADC1  are 
sent  as  primary  information  to  EC1  and  EC2. 

In  case  of  failure  of  ADC1  the  TCC  selects  ADC2  and  sends  these  datas  to  EC1  and  EC2 
In  case  of  failure  of  TCC,  A  EC  I  is  telated  to  EC1,  and  ADC2  to  EC2. 


R.P.Wanger.  US 

You  have  shown  the  future  anticipated  development  of  the  throttle  controls  and  the  engine  controls.  Do  you  also 
anticipate  future  development  requirement  for  the  ARINC  429  data  bus? 

Author's  Reply 

For  the  next  10  years,  we  think  that  we  can  stay  with  the  present  ARINC  429  data  bus,  especially  taking  into 
account  the  definition  of  the  “high  speed”  bus  and  eventually  the  “very  high  speed”  bus. 

If  there  are  requirements  for  future  development  or  improvements  of  ARINC  429  data  bus,  AEROSPATIALE  will 
anticipate  that. 


J. Dunham,  UK 

In  a  future  system,  do  you  believe  thrust  rating  control  should  be  assigned  to  the  autothrottle  or  to  the  engine 
control  computer? 

Author’s  Reply 

Understanding  that  thrust  rating  control  means  Nl/EPR  ratings  computations,  the  author’s  opinion  is  that  these 
computations  mid  remain  on  the  aircraft  side. 

The  main  reason  is  that  the  aircraft  manufacturer  has  to  be  sure  of  good  correlations  between  power  management 
curves  and  engine  performances,  he  has  to  guarantee  the  Airlines  the  total  aircraft  performances  including  aero¬ 
dynamics  and  thrust. 


D.M.Griffiths,  UK 

Two  parameters  were  described  for  achievement  of  thrust  management,  NL  and  pressure  ratio  Pressure  ratio  is 
more  complex  to  implement,  m  your  experience  do  the  results  justify  this  complexity? 

Author’s  Reply 

ERR  is  ‘>f  course  more  complex  to  handle,  our  preliminary  experience  with  A3C0  shipped  with  PWA  engines  shows 
thai  the  final  results  are  the  samp  as  with  N1 . 
thrust  correlation  approximately  same  results 
reaction  time  on  power  setting  EPR  slower 
overshoot  effect  during  take-off  less  with  EPR 
lapse  rate  effect  during  take-off:  more  with  EPR. 
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J.F.O. Evans,  'JK 

( 1 )  Incorrect  thrust  control  during  critical  flight  regimes  is  undesirable.  How  does  the  author  believe  that  airlines 
and  aircrew  will  obtain  confidence  in  such  thrust  control  systems? 

(2)  If  we  are  relying  on  a  supervisory  approach  for  safety  is  the  permissible  thrust  loss  greater  than  the  maximum 
required  trim? 

Author’s  Reply 

(1 )  In  case  of  failure  of  electronic  control  during  take-off  for  instance,  fail  fixed  logic  existing  within  the  elect¬ 
ronic  control  ensures  automatically  that  HMC  remains  on  last  correct  power  lever  position 

No  immediate  action  from  pilot  is  required. 

(2)  No  see  Figure  6  of  the  paper. 


D. Stanley,  UK 

What  percentage  increase  in  engine  life  is  anticipated  with  the  use  of  the  A3 10  system  of  engine  control,  and  what 

future  improvement  is  to  be  expected  on  Future  ‘  1  ’  and  Future  ‘2’?  Will  the  engine  manufacturer  give  a  guarantee? 

Author’s  Reply 

( 1 )  Use  of  electronic  control  for  A3 1 0  engines  decreased  EOT  peak  on  take-off  within  a  range  of  3  to  5°C,  and 
increases  engine  life  on  wing  by  600  hours  or  more.  (General  Electric  Information).  For  future  engines, 
additional  increase  of  life  time  is  expected. 

(2)  The  electronic  control  is  a  basic  part  of  the  engine,  therefore  the  guarantee  the  engine  manufacturer  gives 
includes  electronic  control. 


J.M.Legg,  UK 

How  is  the  Turbine  Entry  Temperature  controlled  with  the  A3 10  supervisory  engine  control9 
Author’s  Reply 

The  supervisory  engine  control  is  defined  for  constant  EGT  ratings  and  EGT  peak  protection. 

In  addition,  for  the  PWA  JT9D  engine,  the  EGT  is  directly  taken  into  account  in  the  control  loop. 
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CONTROL  OF  ALTERNATIVE  ENGINES  BY  MICROCOMPUTER  SYSTEMS 

by 

C.  Casci,  F.  M.  Montevecchi ,  B.  Abbiatl 

C.  N.  P.  M.  National  Research  Center  for  Energetics  and  Propulsion 
Milan,  Italy 


ABSTRACT 

The  paper  will  present  aims  and  results  of  the  research  work  carried  out  in  the  field  of  fuel  system  control  in  in¬ 
ternal  combustion  engines. 

'Hi re e  cars  -  FIAT  127,  FORD  Fiesta  and  ALFA  ROMEO  Alfasud  -  have  been  provided  with  a  microcomputer  to 
control  mixture  ratio  by  means  of  floating  chamber  pressure  regulation  <n  the  carburetor. 

A  complex  feedback  control  loop  adjusts  pressure  level  depending  upon  exhaust  gases  oxigen  contents. 

Experimental  testing  of  the  device  evidentiated  the  dependence  of  control  system  time  delay  upon  rpm  along  with  sen¬ 
sitivity  to  manifold  geometry,  sensor  positioning,  and  related  engine  design  details.  Implemented  control  has  taken 
Into  account  rpm  in  relation  with  the  forecast  map  of  specific  engine.  Tests  have  been  carried  on  both  at  constant  rev. 
speed  and  in  ECE  15  emission  test.  Engine  design  parameters  and  sensor  location  showed  a  strong  influence  on  con¬ 
trol  s'  stem  performance. 

Results  evidentiated  inherent  limitations  in  control  loop  efficiency  related  to  the  use  of  exhaust  sensors.. 

Die  closed  loop  approach  looks  potentially  capable  of  controlling  automotive  engines  in  the  demanding  future  operatio¬ 
nal  requisites.  Erogress  is  dependent  upon  improvement  in  air-fuel  mixing  techniques  and  in  combustion  sensors. 

INTRODUCTION 

hi  the  last  years  the  use  of  microcomputer  systems  to  control  automative  engines  spread  In  the  R  &  D  area  in  or¬ 
der  to  cope  with  the  demand  of  more  stringent  emission  standards  and  -  in  more  recent  times  -  of  more  efficient  fuel 
consumption  (  1  ),  (  2  ),  (  3  ),  (  4  ). 

Die  National  Research  Council  -  C.  N.  R.  -  of  Italy,  having  sponsored  a  large  research  program  in  Energy  Sa¬ 
vings  (  5  ),  supported  in  the  last  three  years  the  research  work  whose  results  are  being  in  part  communicated  here  in. 
Partecipants  have  been  the  C.  N.  P.  M.  -  National  Research  Center  for  Energetics  and  Propu’sion  -  of  Milan  and  the 
Dell'Orto  Carburator  Company  of  Seregno,  Italy.  Aim  of  the  research  program  was  to  demonstrate  the  possibility  of 
microcomputer  based  control  systems  for  control  of  carburetor  engines  in  closed  loop  configuration.  By  the  way  the 
research  was  also  intended  to  investigate  collateral  problems  in  the  snnsors  and  in  the  carburetor  and  engine  design 
areas. 


Diis  presentation  will  deal  with  a  brief  summary  of  current  trends  in  Alternative  Engine  Control  and  a  more  de¬ 
tailed  description  of  tests  carried  on  and  experimental  results. 

The  car  system  design  problem  has  met  the  technological  innovation  of  LSI  electronic  components.  As  a  conse- 
quen  'e  in  the  system  multilevel  design  several  level  objectives  have  been  deeply  modified  because  of  the  innovation 
that  vi.s  to  be  considered.  A  large  variety  of  options  could  also  be  introduced  with  a  very  low  additional  -  cost/option 
-  obj  ictr'e  cost  ratio.  Being  still  in  a  very  massive  evolutionary  phase  car  system  design  solutions  have  not  yet  met  a 
comn  only  agreed  definition  in  several  details.  Yet  design  objectives  at  high  system  design  level  are  quite  clear  and 
strong ly  demand  for  innovation  applications,  among  which  chiefly  : 

lower  fuel  consumption,  ; 

lower  emission,  } 

good  driveability, 
high  reliability, 

high  safety  standards.  i 

The  present  development  status  shows  both  incertitude  in  subsystem  choice  and  in  optimizing  criteria. 

As  far  as  alternative  engines  are  concerned,  assuming  that  on  -  chip  mieropi  ogrammable  circuits  and/or  the  ra-  \ 

pidiy  growing  variety  of  specialised  or  derived  devices  will  provide  the  technical  answer,  the  engine  controller  sub-  ] 

system  is  faced  by  at  least  two  rather  distinct  development  trends,  letting  apart  the  problem  of  option  integration.  \ 

Die  first  one  is  to  build  up  the  system  as  a  diagnostic  and  controlling  device,  the  second  one  is  to  provide  only  a  clo-  j 

sed  loop  regulation.  In  the  first  case  a  heavy  processing  task  and  a  sophisticated  softw  are  are  envisaged  -  and  a  lar-  I 

ger  set  of  options  can  be  integrated  by  the  way.  In  the  second  case  the  interaction  net  within  the  system  design  is  cut  • 

smaller  and  both  limitations  and  advantages  can  be  forecast.  i 

i 

Our  research  work  was  intended  to  operate  in  the  latter  area  that  is  to  provide  a  fuel  system  by  driving  a  rather  s 

crude  carburetor  by  means  of  a  microcomputer  based  control  sj stem  provided  with  a  regulation  closed  loop.  ] 
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The  actuation  was  performed  by  evaluating  a  pressure  set  point  output  by  the  system  to  the  carburetor  float  chamber 
-  Pressure  Control  Unit  PCU  -  . 

MICROCOMPUTER  CONTROLLED  FUEL  SYSTEM 

A  Dell'Orto  carburetor  model  FRDA  32  F  modified  as  shown  in  Fig.  1,  was  chosen  for  application  of  controlled 
vacuum  in  the  float  chamber.  Ordinarly  the  top  of  carb  chamber  communicates  with  the  air  duct  pressure  is  therefore 
equal  to  the  one  immediatly  after  air  filter  -  (6),  (7),  (8)  -  and  -  depending  upon  losses  -  lower  than  ambient. 

By  means  of  connecting  carburetor  float  chamber  to  a  device  capable  od  setting  a  desired  pressure  value  it  is  possi¬ 
ble  to  control  air/fuel  ratio.  This  kind  of  approach  was  selected  because  of  its  inherent  simplicity  and  easy  applicabi¬ 
lity  to  preexistent  carb  models;  in  addition  Dell'Orto  Company  had  already  worked  in  the  area  looking  at  vacuum  level 
variations  in  carburetor  chamber  as  a  mean  of  copying  with  altitude  modifications  in  operational  environment.  Further¬ 
more,  this  device  configuration  does  not  need  mechanical  actuators  in  the  carb  such  as  needles,  varying  orifices  or 
others.  Contemporary  control  of  several  carburetors  in  multicarburetor  fuel  systems,  a  case  frequent  in  Europe,  is 
also  allowed  by  using  a  single  controlled  pressure  signal  to  regulate  air/fuel  ratio.  Fig.  2  shows  the  general  arrange¬ 
ment  of  the  controlled  engine. 

In  order  to  provide  a  CO  feedback  signal  a  conventional  CO  Bosch  tester  had  been  used  in  the  preliminary  stages. 
The  response  time  7  ;•  1 0  s  allowed  only  steady  operation  control.  A  Zirconia  Oxygen  Sensor  from  Bosch  was  there¬ 
fore  routinely  adopted  to  run  the  control  loop.  The  response  time  of  Zirconia  sensor  varies  depending  upon  the  tempe¬ 
rature  and  flow  rate  of  exhaust  gases  (  9  );  in  most  eases  a  time  in  the  30  to  300  ms  band  can  be  expected.  For  these 
values  of  response  time,  a  rather  good  transient  behaviour  for  the  control  system  could  be  anticipated  if  several  de¬ 
lays  were  not  present  due  to  the  effect  of  other  engine  components.  In  our  case  we  met  the  following  delays  : 

Electronic  delays 

a)  Analog  digital  conversion  and  data  acquisition  delay  -  1  OO^us  - 

b)  Computational  time  to  compare  actual  and  desired  value  -  200 ^us  - 

c)  Computational  time  to  calculate  the  pressure  value  to  be  set  -  7  -*  30  ms  - 

Hie  abovementioned  values  are  depending  upon  the  hardware  adopted  and  upon  the  software  implemented;  more  sophi¬ 
sticated  hardware  better  matched  with  softwaie  requisites  could  diminish  the  total  electronic  delay  till  tolf  2  ms. 

Actuation  delays. 

Atypical  response  is  shown  in  Fig.  3.  The  total  delay  for  an  intervention  through  the  pressure  band  limits  is  about 
100  ms.  Because  of  the  chocken  operation  of  the  eleetrovalves  lower  figures  are  to  be  expected  for  smaller  interven¬ 
tions;  in  normal  operation  60  ms.  is  a  rather  indicative  figure. 

Carburetor  delays. 

At  4000  rpm  for  a  step  pressure  variation  in  the  chamber  about  15  ms.  are  needed  to  vary  fuel  flow  -  (  11  ),  (  12  )  -  . 
Inlet  duct  delays. 

As  it  has  been  already  evidentiated  (  11  )  wall  adhesion  and  spray  or  film  wall  -  effects  in  ducts  between  carburetor 
and  inlet  poits  slow  down  fuel  flow  transients;  delay  time  values  are  strongly  affected  by  several  geometrical  and 
thermofluidodynarr.ic  factors  in  inlet  duct  configuration.  Time  delay  figures  stay  above  0.  2  a  0.  3  s  even  in  the  most 
favourable  conditions. 

Combustion  chamber  and  exhaust  port  delays. 

Slow  temperature  variations  in  combustion  chamber  and  in  outlet  valve  ducts  affect  the  exhaust  g".s  chemical  composi¬ 
tion.  Rapid  engine  rpm  transients  are  therefore  followed  by  slow  theimic  transients  whose  time  delays  occur  in  seconds. 

Zlnoonia  Qxlgen  Sensor  delays. 

As  previously  discussed  vary  between  30  and  300  ms. 

Table  1  shows  delays  values  as  a  function  of  our  actual  development  level  and  improved  versions;  the  figures  at 
the  ideal  level  correspond  to  the  rather  optimistic  assumption  of  being  able  vo  adopt  a  sensor  to  diagnosticate  le.in  or 
rich  combustion  by  means  of  knock  detection  (12),  (13).  Even  in  this  case  a  total  delay  time  for  the  regulating  system 
cannot  be  lower  than  1  s ,  chiefly  due  to  delays  in  the  Inlet  duct.  This  time  value  is  too  high  to  provide  for  closed  loop 
regulation  in  rapid  engine  transients,  especially  for  engines  with  mechanical  gear  -  shift.  Since  Zinc onia  Oxigen  sen¬ 
sors  or  similar  exhaust  gas  sensors  depend  on  thermic  transients  in  combustion  chamber  and  exhaust  system  it  looks 
like  they  will  never  be  able  to  cope  with  rapid  engine  transients. 

COMPARATIVE  TESTS  IN  THREE  PRODUCTION  SMALL  SIZE  CARS 

Comparative  tests  have  been  run  fitting  three  cars  with  the  PCli  control  system.  Cars  were  Alfasud  from  ALFA 
ROMEO,  FORD  Fiesta  1.  3  and  FIAT  127  x  950  cm3.  Preliminary  tests  were  intended  to  define  the  sampling  interval 
-At  -  to  be  adopted  by  the  PCU  in  order  to  allow  a  stable  regulation  loop.  It  was  supposed  that,  at  low  rpm,  delays  In 
the  inlet  ducts  had  to  be  longer  and  therefore  relations  between  At  and  rpm  was  investigated.  Plots  in  Fig.  4,  5  and  6 
show  relations  between  Act  and  rpm.APv  values  to  be  set  in  the  carb  chamber  to  obtain  steady  state  stoichiometric  air 7 
fuel  ratio  is  also  shown.  As  it  can  be  easily  observed  peculiar  trends  are  typical  for  each  car  tested  as  a  consequence 
of  differences  in  design  of  manifold  duct. 
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The  distance  of  the  oxigen  sensor  from  the  outlet  ports  was  also  different  and  certainly  affected  the  results  :  49  -t 
58  cm.  for  Alfasud;  35  cm.  for  FORD  Fiesta  and  30  cm.  tor  FIAT  127.  While  a  shorter  distance  in  FIAT  127  could 
favour  lesser  At  values  it  is  not  probable  that  it  did  affect  the  reverse  trend  that  At  values  show  in  FIAT  127  tests  as 
compared  to  other  cars.  The  inlet  ducts  in  FIAT  127  are  integrated  into  the  engine  head  in  an  arrangement  quite  diffe¬ 
rent  from  the  other  cars  considered.  Thermic  conditions  and  fuel  -  wall  interactions  are  likely  to  be  quite  influenced 
by  the  design  configuration  and  we  consider  these  experimental  data  as  supporting  the  ipothesis  of  a  strong  sensitivity 
of  the  control  system  in  the  whole  towards  manifold  duct  design.  It  could  be  guessed  that  a  higher  inlet  duct  tempera¬ 
ture  in  FIAT  127  at  low  rpm  evaporates  almost  totally  the  wall  -  adhering  fuel;  at  higher  rpm  the  turbolence  effect  is 
the  main  factor  for  air  -  fuel  mixing  and  it  is  shared  by  the  three  cars  observed  giving,  by  the  way,  very  similar  A  t 
values  at  high  rpm. 

Other  peculiar  phenomena  were  also  evidentiated,  in  the  FORD  Fiesta  at  very  low  engine  rpm  the  PCU  control 
system  was  sensitive  to  drops  of  fuel  from  the  main  jet  that  could  not  close  perfectly  at  low  rpm.  The  short  inlet  ducts 
in  Fiesta  were  not  able  to  filter  the  fuel  flow  noise  determined  by  the  drops  while  the  other  cars  were  not  sensitive. 

RESULTS  OF  EMISSION  TESTS 

Constant  rpm  tests  gave  very  repetitive  results.  Fig.  7  shows  CO  and  C02  values  versus  the  pressure  regulated 
in  the  carburetor  floating  chamber,  ECE  15  emission  test  have  been  carried  out  at  different  temperature  conditions 
for  the  engine.  A  cold  cycle  is  run  at  initial  lubricating  oil  temperature  in  the  20  t-  33  '  C  range.  A  warm  cycle  is 
run  at  initial  oil  temperature  in  the  50-:  55  '  C  range. 

Several  factors  influence  the  overall  results.  The  most  affecting  parameter  is  the  sensor  temperature.  Since  Zin- 
conia  Oxigen  Sensors  give  reliable  measurements  only  at  temperatures  above  380  j-  400  '  C  tests  in  which  the  sensor 
was  not  in  proper  temperature  range  -  partially  or  totally  -  gave  poor  results. 

Modifications  to  better  the  system  performance  were  therefore  introduced  chiefly  :  exhaust  pipes  were  thermally 
insulated  to  stabilize  higher  temperatures,  the  electric  radiator  fan  air  flow  was  diverted  in  order  not  to  cool  the  ex¬ 
haust  pipes,  sensor  positioning  was  modlefied  to  stay  more  protected. 

Typical  results  are  shown  in  Fig.  8  were  CO  C02  and  HC  concentrations  are  plotted.  Peaks  in  the  CO  concentra¬ 
tion  are  still  evident  in  acceleration  regions  though  largerly  inferior  to  the  ones  occured  without  taking  care  to  ther¬ 
mal  conditions. 

In  general  the  system  is  capable  to  control  CO  concentration  within  acceptable  limits  In  5  t-  6  seconds  HC  emis  - 
sions  are  fairly  good;  It  must  noticed  that  high  peaks  occuring  in  decelerations  are  present  in  almost  all  fuel  systems 
and  cannot  be  eliminated  unless  the  fuel  flow  is  almost  totally  stopped;  in  this  case  yet  other  inconveniences  occur  - 
too  lean  mixtures,  mlsfirings  -. 

Numerical  values  for  CO  C02  and  HC  concentrations  are  shown  in  Table  2  for  an  ECE  15  test  on  ALFA  ROMEO 
Alfasud  car.  The  results  are  equal  to  the  ones  obtained  with  very  sophisticated  traditional  carburators. 

These  results  suggest  that 

performance  of  the  control  system  Is  capable  to  outperform  traditional  carburetors  provided  further  improvements 

are  implemented, 

in  the  long  term  the  repeatibility  of  results  due  to  the  closed  loop  control  still  now  gives  an  edge  to  the  system 

tested  over  traditional  carburetors. 
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FUTURE  DEVELOPMENTS 

A  series  of  considerations  can  be  drown  in  the  areas  of. 

Improvements  applicable  to  the  system. 

Inherent  limits  of  the  system  tested. 

Improvements  under  evaluation  consider  throttle  position  signal  and  rpm  derivative  as  possible  signals  to  be  used 
to  better  control  acceleration  and  deceleration  transients.  Even  with  rough  analysis  a  simple  map  of  engine  behaviour 
in  fast  transients  and  at  low  rpm  is  likely  to  better  actual  performances.  If  in  this  area  further  improvements  were  to 
be  looked  after,  the  importance  ot  the  engine  performance  map  could  overcome  the  closed  loop  regulation  philosophy. 
At  present  we  do  not  feel  this  step  necessary  particularly  if  shortcomings  of  this  approach  are  going  to  be  kept  in  con¬ 
sideration, 

A  limited  mapping  anyway  is  needed  for  cold  starting,  fast  rpm  variations  and  possibly  low  rpm  operating  regions. 
This  mapping  does  not  seem  to  need  selfadjusting  diagnostic  procedures. 


Engine  design  needs  several  modifications  to  better  match  the  control  system,  chiefly  in  the  areas  : 
inlet  duct, 
carburetor, 
exhaust  system. 

Combustion  sensors  based  on  the  knock  detection  principle  or  others  promise  further  improvements  for  the  closed 
loop  systems  and  appear  the  most  promising. 


CONCLUSIONS 


The  research  work  carried  out  in  the  control  of  carburators  by  means  of  electronic  systems  has  shown  the  capa¬ 
bility  of  at  least  equalling  the  best  traditional  carburator  performances. 

The  closed  loop  philosophy  of  the  control  system  appear  potentially  capable  of  coping  with  desired  performances 
without  necessity  of  sophisticated  engine  performance  mapping. 

Improvements  in  sensors  to  diagnosticate  combustion  and/or  combinations  of  actual  sensors  promise  a  solid  futu¬ 
re  for  the  closed  loop  regulation.  These  systems  will  never  overcome  transient  time  delay  in  the  manifold  inlet  duct, 
as  a  consequence  the  response  time  of  the  regulation  will  hardly  be  less  than  0,  6  s-  0.  8  s.  Only  major  advances  in  fuel 
air  mixing  techniques  could  substantially  improve  closed  loop  system  response  time. 
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DISCUSSION 


R.De  Hoff,  US 

( 1 )  What  type  of  signal  compensation  was  used  to  form  the  actuator  commands  from  the  oxygen  sensor  signals? 

(2)  Do  you  think  that  more  complex  sensor  compensation/regulation  forms  can  improve  emission  performance 
during  transients? 

Author’s  Reply 

( 1 )  Oxygen  sensor  signal  is  looked  at  as  a  lean  or  rich  signal  -  two  state  -  obviously  at  low  temperatures  the  signal 
is  excluded.  The  regulation  aim  is  to  cross  the  stoichiometric  ratio  by  means  of  an  increase  in  correction  as 
long  as  control  is  staying  in  one  side.  A  limit  in  the  AP  variation  rate  is  provided. 

(2)  Yes.  The  transient  operation  is  very  often  characterised  by  low  temperatures  in  the  sensor  -  a  limited  mapping 
of  the  engine  which  takes  into  account  rpm  variation  rate  and  throttle  positioning  is  actually  implemented.  We 
consider  anyway  that  for  the  specific  system  developed,  more  sophistication,  if  desirable,  must  not  impair  the 
simplicity  and  the  large  applicability  which  has  been  obtained. 

Let  me  point  out  that  for  three  stock  cars  the  same  computer  board  with  only  an  on-board  dip  switch 
adapation  is  capable  of  satisfying  ECE  1 5  emission  requirements. 
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SUMMARY 

The  object  of  the  papier  is  to  review  the  trends  in  gas  turbine  engine  control  systems  and  to  show 
the  work  that  is  underway  to  meet  future  demands. 

The  emphasis  is  on  digital  systems,  and  because  of  this  the  point  is  immediately  apparent  that 
there  is  a  definable  pattern  between  diverse  applications.  Thus  there  is  a  degree  of  commonality  in  both 
the  hardware  and  software  for  controls  for  helicopters ,  civil  transport  engines ,  industrial  gas  turbines  and 
at  the  top  of  the  complexity  spectrum  the  control  for  advanced  Military  power  plant. 

The  theme  of  the  paper  concerns  this  generality,  and  its  achievement  with  examples  from  different 
applications.  From  the  results  of  this  present  work  some  ideas  are  then  put  forward  on  the  next  stage  and 
the  problems  and  opportunities  that  are  likely  to  be  met. 

INTRODUCTION 


Engine  control  systems  currently  in  production  are  in  the  main  either  hydromechanical  with  some 
limited  authority  analogue  trimming  device,  or  full  authority  analogue  controls.  In  the  first  category  are 
controls  on  such  engines  as  the  Rolls  Royce  Spey  and  RB.211,  while  those  with  full-authority  dual  lane 
electronics  include  the  Olympus  593  and  the  RB.199.  In  the  helicopter,  industrial  and  marine  field  the 
same  pattern  emerges,  though  here  the  approach  is  to  have  some  form  of  simple  hydromechanical 
reversionary  control  instead  of  dual  lane  electronics. 

In  general  the  control  system  for  each  application  civil,  industrial,  helicopter,  military  is 
different,  and  there  is  very  little  commonality  of  haidware.  Obviously  there  is  a  different  emphasis  on 
the  requirements,  and  special  problems  in  each  area.  Thus  the  helicopter  has  rotor  governing  with  its 
complex  response  requirements,  the  industrial  control  has  sequencing  and  a  larger  display  requirement, 
the  civil  engine  has  thrust  rating  and  the  requirement  for  good  efficiency  and  long  life;  the  military  engine 
has  hiqher  complexity  with  reheat  and  some  variable  geometry.  Similarly  the  fuel  flow  requirements 
from  the  simple  APU  to  the  full  Concorde  type  system  are  different  and  so  different  pumping,  interface 
and  distribution  systems  are  necessary. 

CONTROL  CONFIGURATION 


A  set  of  alternatives  for  a  main  engine  gas  turbine  control  system  is  shown  in  block  form  on 
Figure  1.  The  lower  part  of  the  diagram  shows  that  irrespective  of  the  final  system  there  are  elements 
which  are  common  to  all.  Thus  in  simplified  terms  there  is  a  pump  package  which  comprises  a  backing 
pump,  main  pump,  relief  valve,  sometimes  an  integral  filter,  and  perhaps  a  speed  probe,  or  an  alternator 
to  drive  the  control  electronics. 

The  next  package  consists  of  a  main  throttle  or  variable  metering  orifice  (VMO)  to  control  the 
fuel  flow  with  a  pressure  drop  mechanism  operating  a  spill  valve  to  spill  excess  fuel  back  to  pump  inlet. 
This  VMO  can  be  operated  directly  or  by  a  servo.  It  is  this  item  which  can  take  on  a  variety  of  forms:' 
hydromechanical,  pneumatic,  electronic  or  selective  combinations. 

From  the  main  throttle  valve  flow  passes  to  the  shut  off  valve  and  hence  to  the  sprayer  distribution 
system.  In  certain  cases  separate  overspeed  or  overtemperature  limiters  are  provided  either  operating  on 
the  shut-off  valve  or  through  some  separate  spilling  device. 

All  the  elements  in  the  main  fuel  line  are  functions  of  engine  size  since  they  aie  dependent  upon 
fuel  flow.  The  control  or  computer  elements  -  whether  hydromechanical  or  electronic  are  independent  of 
the  flow  metering  and  are  a  function  only  of  the  engine  input  signals,  pilots  lever  and  tne  control  algorithms 
l.e.  acceleration,  deceleration  range  governing  etc. 
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FIG.  1.  Alternative  Control  Configuration 


The  alternate,'’  foims  which  this  Control  can  take,  and  which  are  being  considered  in  various 
applications  are:- 

(a)  Full  hydromechanical 

(b)  Full  hydromechanical  with  a  supervisory  electronic  trim 

(c)  Full  electronic  with  a  changeover  in  case  of  failure  to  a  hydromechanical  back  up. 

(d)  Full  electronic  with  a  changeover  in  case  of  failure  to  a  further  electronic  unit. 

At  no  point  are  systems  being  considered  at  the  moment  with  only  one  lane  of  electronics  without 
manual  back  up.  Similarly  there  are  no  systems  being  considered  -  as  with  avionic  and  fly  by  wire 
systems  -  which  are  triplicated. 

The  supervisory  control  (b)  is  being  considered  for  civil  aircraft  and  can  be  looked  upon  as  a 
halfway  house,  towards  the  full  electronic  systems.  Systems  (c)  and  (d)  both  provide  dual  redundancy, 
hut  the  first  uses  a  mechanical  back  up.  The  degree  and  complexity  of  ihe  back  up  system  depends  upon 
the  application,  the  mission  requirements,  the  number  of  engines  and  the  complexity  of  the  control  problem. 
One  approach  is  to  use  the  minimum  amount  of  hardware  and  in  the  limit  the  control  could  consist  of  a 
pilot  operated  tap  with  perhaps  some  altitude  compensation. 

The  real  choice  depends  upon  a  detailed  study  for  each  application  showing  the  advantages  in  terms 
of  weights,  cost  of  ownership,  complexity,  reliability  and  above  all  integrity  targets.  The  reasons  for  the 
range  of  options  are  partially  a  measure  of  the  faith  which  the  operator  ha.-  in  the  integrity  and  ieliability 
of  the  electronics.  With  a  hydromechanical  control  there  are  millions  of  hours  flight  experience  to  back 
up  any  prediction;  with  a  digital  system  this  experience  is  lacking. 

Fur the>'  and  perhaps  more  importantly,  service  returns  on  hydromechanical  units  show  that  less 
than  5%  -  10%  of  all  confirmed  defects  result  in  flame  out  or  engine  shut  down.  In  general  the  type  of 
faults  occurring  with  hydromechan.cal  units  are  mainly  as  a  result  of  some  wear  which  occurs  at  a  slow 
rate.  The  early  results  of  this  wear  are  changes  in  calibration,  perhaps  hysteresis.  Because  the  process  is 
gradual  it  can  be  sensed  by  its  effect  on  the  engine  and  the  chances  of  any  degradation  in  control  causing 
engine  damage  are  slight. 

With  electronic  controls  this  is  not  so,  and  except  in  special  cases  there  is  no  equivalent 
"graceful  degradation".  Thus  either  the  electronic  control  must  be  10  times  more  reliable  than  the 
equivalent  hydromechanical  unit  (to  achieve  the  same  in  flight  shut  down)  or  dual  redundancy  must  be  used. 

Hence  the  range  of  options.  Considering  however,  the  digital  control  unit  in  the  d’fferent 
configurations,  it  can  be  shown  that  these  are  remarkably  similar. 
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DIGITAL  CONTROLLER 


Structure 


FIG.  2  Digital  Control  Structure 


In  simple  terms  the  role  of  the  digital  controller  in  the  above  applications  is  to  take  in  a  set  of 
input  signals, to  convert  them  into  digital  form  and  to  condition  them  viz  filtering  and  isolation,  to  process 
them  according  to  processor  predefined  program  instructions  and  to  output  the  results  in  the  manner 
required.  The  methods  used  to  input  and  output  the  data  are  standard  for  any  application.  The  system  is 
"customised"  to  its  final  application  by  means  of  specific  inputs  and  outputs  and  the  specific  program 
instructions. 

A  simplified  diagram  of  a  typical  microprocessor  control  is  shown  on  Figure  2.  On  the  left  hand 
side  are  the  inputs  and  on  the  right  hand  side  the  outputs.  The  central  portion  of  the  diagram  shows  the 
processor  with  its  interface  to  the  inp.  t/output  highway  and  its  connection  to  the  memory.  The  memory 
highway  is  a  high  speed  parallel  bidirectional  highway  but  because  of  the  reduced  throughput  the  I/O 
liighway  may  be  serial  (cabling  requirements  can  thus  be  reduced  from  over  19  wires  to  8  or  less). 

The  memory  consists  of  two  areas:  one,  programmable  read  only  memory  for  the  control 

program  and  read  only  memory  for  storage  of  temporary  results.  A  specific  area  of  the  PROM  is 
usually  dedicated  to  constants,  datums,  gains  which, cater  for  some  future  cnange  with  minimum 
disruption  to  the  memory. 

Attached  to  the  processor  is  a  crystal  controlled  clock  which  provides  a  reference  timing  or 
frequency  source  and  is  divided  down  to  provide  reference  signals  for  speed  measuring  circuits  and  the 
sample  rate  interrupt. 

The  other  item  is  the  power  module.  Standardisation  is  possible  here  since  it  is  required  to 

take  in  standard  aircraft  power  supplies  and  produce  regulated  voltages,  typically  5v,  1  15v  and  28v 

to  power  the  circuits  within  the  unit.  In  applications  to  date,  the  use  of  a  dedicated  generator  has 
presented  little  problem,  since  these  have  been  supplied  with  their  own  rectifier /regulator  units 
producing  a  nominal  28v  dc. 
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Input  -  Output  Signals 

The  structure  above  has  been  discussed  without  reference  to  application  and  it  can  be  seen  the 
hardware  composition  can  be  the  same  for  say  a  supervisory  trimming  control  or  a  helicopter  or  a  dry 
engine  single  lane  control.  The  amount  of  store  will  depend  on  the  application  but  even  here  store  is 
available  in  blocks  and  in  general  store  requirements  are  similar.  Hence  a  module  containing  the 
processor,  the  store  and  clock,  would  have  a  common  use. 


Consider  now  the  input  requirements  for  the  different  applications.  Figure  3  shows  the 
parameters  required  for  five  current  development  programmes . 


FIG.  3  Input  Requirements 


By  having  modules  for  each  input  and  each  output  a  standard  "pack  of  cards"  can  be  created  from 
which  a  selection  can  be  made  for  any  application.  The  cards  will  then  interface  to  the  processor  and 
store  modules  above. 


Self  Monitoring  and  Testing 

It  has  been  a  general  experience  that  as  aircraft  have  become  more  sophisticated,  and  the  numbers 
of  electronic  systems  installed  have  multiplied,  so  the  ratio  between  maintenance  and  flying  hours  has 
increased.  This  trend  has  been  particularly  marked  in  engine  control  systems,  where  in  recent  years  we 
have  seen  the  introduction  of  complex  electronic  systems  into  the  most  demanding  environment  on  the 
aircraft,  and  into  the  area  of  responsibility  of  maintenance  personnel  whose  experience  is  predominantly 
mechanical.  When  these  factors  are  applied  to  systems  with  somewhat  limited  test  facilities,  the  result  is 
a  predictably  high  removal  rate  and  a  lot  of  unnecessary  maintenance  actions. 

Digital  systems  offer  the  best  solution  to  these  problems,  in  that  it  is  relatively  easy  to  provide 
effective  built-in-test  equipment  (BITE)  with  minimal  additional  hardware.  A  number  of  engine  control 
systems  will  be  discussed  in  the  following  pages,  and  all  of  them  have  BITE  capability  based  upon  the  use  of 
the  control  computer.  The  only  real  variation  between  the  systems  lies  in  the  hardware  approach  tc 
checking  that  the  computer  system  is  functional. 

Given  that  the  control  computer  is  fully  operational  within  the  system,  then  it  can  be  used  to  check 
out  other  components  within  the  control  loop.  The  input  signal  conditioning  circuits  are  amenable  to 
credibility  checks,  of  which  three  are  particularly  easy  to  apply,  namely 

(a)  The  input  signal  is  measured  and  compared  with  predetermined  limiting  values 

(b)  Input  signals  are  sampled  at  fixed  intervals  so  that  the  difference  between  successive 
values  can  be  compared  each  sample  period  with  stored  maximum  rate  of  change  values. 

(c)  The  computer  may  carry  a  model  of  the  engine  and  fuel  control. 

Outputs  from  the  electronic  controller  are  most  readily  checked  by  feedback  techniques.  Typical 
examples  are  listed  below 

(a)  Electrically  actuated  position  servo  -  pos'tion  signal  fed  back  to  suitable  input 
channel.  The  actuator  loop  can  then  be  exercised  during  giound  check. 

(b)  Torque  motor  drive  -  torque  motor  current  signal  fed  back  to  input  channel, 
allowing  direct  input/output  comparison. 
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(c)  Discrete  output  -  additional  output  switch  driven  from  same  source  is  fed  back  to 
discrete  input  channel. 

Power  supplies  within  a  control  system  are  regulated,  and  can  be  monitored  using  one  or  more 
analogue  to  digital  converter  input  channels .  The  measured  power  supply  voltages  are  compared  with 
preset  numbers  stored  in  the  computer  memory. 

These  tests  provide  an  excellent  basis  for  detecting  faults  both  within  the  electronic  control 
unit  and  within  each  control  loop.  They  all  depend  however  on  effective  computer  monitoring,  which 
is  based  upon  hardware  and  software  checks.  Software  checks  are  of  three  main  types 

(a)  Instruction  check  -  the  computer  executes  a  program  designed  to  exercise 
the  full  range  of  instructions  used  by  the  control.  The  known  result  of  this 
computation  is  checked  by  comparison  with  a  stored  word  in  the  computer  memory. 

(b)  ROM  sumcheck  -  the  control  program  and  its  associated  constants  and 
tables  are  stored  in  fixed  read  -  only  memory.  If  the  computer  adds  up 
all  the  numbers  in  the  ROM  a  known  invariant  answer  should  result. 

(c)  RAM  check  -  the  scratch  pad  memory  is  checked  by  a  program,  writing  l's 
and  0's  to  each  location  in  turn. 

Hardware  checking  is  frequently  carried  out  by  using  a  watchdog  timer.  Normal  computer 
operations  are  timed  by  means  of  a  crystal  controlled  clock.  Operation  of  the  watchdog  timer  is  shown 
in  the  simplified  timing  diagram  of  Fig.  4.  The  sample  rate  clock  interrupt  occurs  at  fixed  intervals. 

At  a  preset  time  after  the  SRC  interrupt,  the  Watchdog  timer  generates  a  window  of  known  short  duration, 
during  which  time  the  computer  must  output  to  it  a  safety  word,  which  has  been  computed  using  the 
software  checking  procedures  outlined  above.  This  safety  word  is  compared  with  a  hard-wired  number 
built  into  the  watchdog  timer,  and  unless  the  computer  has  produced  the  correct  result  at  the  right  time, 
then  the  monitoring  device  inhibits  the  action  of  the  controller  in  a  suitable  fashion.  The  timer  is  usually 
combined  with  another  device,  the  fault  integrator,  to  prevent  excessive  interruption  of  normal  conti ol. 
The  fault  integrator  counts  sample  periods  with  and  without  faults,  and  if  the  ratio  of  bad  to  good  cycles 
exceeds  a  preset  number  then  it  either  latches  the  control  into  a  freeze  mode  or  shuts  it  down,  depending 
upon  the  system  and  plant  safety  requirements. 

If  the  computer  responds  correctly  to  the  watchdog  timer,  then  the  control  cycle  continues  as 
shown  in  Fig.  4.  Firstly  the  output  values  computed  in  the  previous  sample  period  ere  sent  out  to  the 
various  actuators  and  output  peripherals,  then  new  input  values  are  read  in,  checked,  and  used  in  the 
control  and  safety  calculations.  The  cycle  then  repeats  itself. 

The  monitored  digital  computer  is  thus  capable  of  providing  comprehensive  built-in  test  facilities 
in  a  system  with  the  addition  of  minimum  hardware.  If  fault  codes  are  allocated  to  each  checking 
procedure  during  software  design,  then  the  computer  can  be  used  to  locate  and  log  in  a  dedicated 
non-volatile  memory  any  faults  that  have  occurred  during  a  period  of  operation.  It  then  becomes 
standard  procedure  to  read  out  the  fault  codes  if  any  malfunction  is  suspected,  and  also  at  regular 
maintenance  periods. 
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FIG.  4  System  Timing  Diagram 
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SOFTWARE 
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FIG.  5  Hierarchy  Chart 

Experience  on  different  applications  with  a  range  of  microprocessors  (Intersil  IM6100,  Texas 
SBP  9900,  Ferranti  F100L,  Motorola  6802) ,  has  shown  the  need  for  software  standards  which  have  to  be 
rigorously  applied.  The  standards  refer  to  documentation,  traceability  and  change  control.  The  best 
approach  has  been  to  follow  the  equivalent  hardware  principles. 

Software  is  designed  on  a  hierarchical,  modular  basis.  The  total  software  task  is  decomposed 

into  a  number  of  functionally  free-standing  software 
modules  ranging  from  those  at  the  highest  level 
defining  system  strategy,  such  as  interrupt  handlers, 
to  the  basic  arithmetic  and  logical  ouilding  blocks. 

Fig.  5  shows  a  typical  software  hierarchy  chart  which 
is  drawn  up  at  the  beginning  of  the  design  process. 

It  will  be  noticed  the  actual  'control'  part  of  the 
hierarchy  is  only  one  part  and  that  safety,  data 
validitation ,  ground  test  interrupt  structure  are  as 
relevant  -  and  these  are  common  across  a  number 
of  applications. 

Because  control  engineei  s  have  been  trained  on 
simulation  vdth  analogue  type  control  diagrams  we 
have  developed  our  own  control  language  which  is 
independent  of  the  computer  and  its  associated 
assembly  language.  It  is  based  on  our  Simulation 
language  developed  in  1969  (Ref.  3)  and  has  a  , lumber 
of  definable  functional  blocks  (viz  adders, 
integrators,  lead/lag  networks,  logic)  See  Fig.  6. 

The  control  engineer  'describes'  his  system  from  his 
control  diagram  with  the  appropriate  blocks,  lists 
them  and  passes  them  through  a  diagnostic  and  check 
computer  program.  The  pain  of  'debugging'  thousands 
of  assembly  programme  statements  has  therefore 
been  eliminated.  This  process  is  applied  to  each 
block  in  the  hierarchy  chart. 

A  small  software  team  maintains  the  library  modules 
and  generates  the  necessary  software  support 
documentation.  These  include  retrieval  utilities, 
change  programs  and  acceptance  tests. 

The  advantages  of  the  approach  are:  logical  sub¬ 
division  of  the  task,  early  integration,  independent 
testing,  reliance  on  key  personnel  avoided,  visibility 
and  use  of  standard  proven  modules. 


FIG.  6  Software  Modules 


APPLICATIONS 


Objective 

The  object  in  the  next  section  is  to  show  how  the  widely  different  applications  and  requirements 
outlined  in  the  early  part  of  the  paper  can  still  be  met  with  the  generalised  hardware  and  software 
described  under  the  digital  controller.  The  emphasis  will  be  on  some  of  the  special  features  of  each 
system  and  not  on  the  basic  digital  hardware  and  software. 

HELICOPTER 


The  helicopter  control  has  to  be  low  cost  yet  have  high  integrity  and  still  meet  the  sophisticated 
transient  requirements  of  rotor- governing .  The  system  presently  under  development  for  the  US  Army 
ATDE  programme  consists  of  two  engine  mounted  units. 

( 1)  A  fuel  metering  package  containing  backing  pump,  filter  and  main  fuel  pump, 
fuel  metering  valving,  for  both  automatic  and  manual  control  modas,  and  an 
Inlet  Guide  Vane  actuator,  together  with  a  dedicated  alternator. 

(2)  A  single  lane,  full  authority  digital  electronic  controller  providing  compressor 
and  free-turbine  speed  governing,  proper  control  of  engine  transients  and 
transmission  torque  management. 


The  control  uses  the  "Slave  Datum  Principle"  shown  in  elementary  form  on  Fig.  7. 


FIG.  7 


N  dot  CONTROL  CONVENTIONAL  SCHEDULING  CONTROL 


The  datum  for  the  proportional  governor,  instead  of  being  simply  the  required  engine  speed,  is  a 
"Slave  Datum"  derived  from  the  integrating  branch  of  the  control. 


Governing  and  limiting  functions  are  achieved  by  generating  error  signals  for  the  relevant  engine 
parameters  (e.g.  shaft  speed(s),  turbine  temperature,  transmission  torque  etc.)  and  comparing  them 
on  a  lowest  wins  basis.  The  least  positive,  or  most  negative,  error  passes  via  a  limiter  to  the  integrator, 
the  output  from  which  is  the  slave  datum  for  the  proportional  governor.  The  presence  of  this  integrator 
ensures  accurate,  truly  isochronous  governing. 
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Acceleration  and  deceleration  control  is  achieved  by  limiting  the  positive  and  negative  extent  of 
the  input  to  the  integrator.  The  resulting  control  is  closed  loop  on  dN/dt  ("N-dot")  and  operates  in  the 
proportional  mode. 

The  high  closed-loop  content  of  the  control,  which  also  extends  into  the  starting  regime,  leads  to 
a  simplified  fuel  metering  requirement.  The  resulting  control  performance  is  relatively  independent  of 
fuel  metering  calibration,  permitting  the  use  of  a  very  simple  interface  and  giving  a  high  degree  of 
insensitivity  to  wear  and  the  effects  of  fuel  contamination. 

Other  features  of  this  control  configuration  include:  its  reliance  ,  predominantly,  on  shaft  speed 
which  may  be  measured  accurately  with  high  reliability  and  low  cost,  as  the  control  parameter;  the  use  of 
reset  mode  power  turbine  governing,  found  to  be  advantageous  in  helicopter  applications;  the  ability  to 
handle  multiple  governing  and  limiting  requirements  with  a  minimum  of  complexity  and  without  any 
"take-over"  problems. 

Of  interest  is  the  acceleration  control  and  its  effect  on  "Wave  off's"  or  reslams  (  A  wave  off  is 
the  manoeuvre  where  an  engine  having  stabilised  at  high  p>ower  is  suddenly  decelerated  and  then 
immediately  reaccelerated).  A  series  of  such  manoeuvres  is  shown  on  Fig.  8,  The  N-dot  control  provides 
just  sufficient  fuel  to  maintain  the  scheduled  acceleration  rate.  Hence,  during  wave-off  conditions,  the 
overfuelling  is  substantially  reduced  to  maintain  the  same  scheduled  acceleration.  This  reduction  in 
overfuelling  eliminates  the  high  temperature  and  lower  surge  margin  frequently  experienced  with  more 
traditional  flow -scheduling  controls. 

Rotor  governing  and  the  matching  of  the  starboard  and  port  engine  presents  special  problems.  The 
dynamic  characteristics  of  a  typical  rotor  system  is  complex  and  recovery  by  one  engine  after  failure  of 
the  other  is  an  example  where  rotor  governing  and  gas  generator  control  performance  is  at  a  premium . 

SUPERVISORY 


The  Supervisory  Control  is  designed  principally  for  application  to  large  turbofan  engines  in  civil 
aircraft.  A  full  function  hydromechanical  control  is  fitted  to  the  engine,  and  the  electronic  control  is 
used  to  provide  accurate  flat-rating,  limiting  a.id  built-in-test.  Fig.  9  shows  the  main  features  of  the 
control,  which  consists  of  two  electrically  separate  sections  for  the  trim  and  limiting  functions,  each 
having  its  own  power  supplies  and  microcomputer . 

The  main  function  of  the  trim  is  to  control  engine  EPR,  wh.ch  is  measured  by  vibrating  cylinder 
pressure  transducers  and  transmitted  to  the  control  via  an  ARINC  429  serial  highway.  Air  data  inputs  are 
available  on  a  second  ARINC  429  highway,  and  these  parameters  together  with  the  signals  from  dedicated 
transducers  are  used  in  the  rating  and  control  calculations. 

The  limiter  control  normally  drives  the  fuel  control  actuator  and  receives  inputs  from  the  engine 
(NL  and  TGT) ,  which  are  used  for  limiting,  and  the  trim  control  output.  Thus  if  the  control  is 
functioning  correctly  the  trim  carries  out  its  control  calculations  and  then  sends  a  signal  in  serial  digital 
form  to  the  limiter  which  trim.-  the  engine  fuel  accordingly.  Correspondingly  the  iimiter  sends  parameters 
sucli  as  NL  and  trim  position  to  the  trim  control.  The  trim  -  limiter  data  links  are  also  connected  to 
the  control  unit  test  port ,  so  that  a  wide  range  of  tests  can  be  carried  out  at  a  second  -  line  maintenance 
facility  with  appropriate  test  equipment. 
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Notable  features  of  the  trim  control  are  that  the  rating  control  calculations  are  carried  out  over 
four  EPR  control  cycles,  safety  is  based  upon  a  computer/ watchdog  timer  combination  as  previously 
described  and  the  BITE  facility  includes  a  fuel  system  model  which  is  used  firstly  to  minimise  control 
parameter  overshoots  when  the  electronic  unit  takes  over  control  from  the  hydromochanical  system,  and 
secondly  for  fuel  system  condition  monitoring. 

The  limiter  primarily  prevents  engine  NL  and  TGT  from  exceeding  preset  limits.  In  addition 
however  it  has  a  non-volatile  read/ write  memory  which  is  used  to  store  fault  codes,  and  a  fault  display. 
When  installed  on  the  engine  the  unit  will  log  up  any  faults  detected  during  operation,  and  these  may  be 
read  out  as  numbers  on  the  display  at  a  convenient  time.  The  fault  codes  are  remembered  even  when  the 
unit  is  depowered.  This  facility  is  a  most  powerful  maintenance  aid  which  is  particularly  useful  for 
locating  intermittent  faults. 

ADVANCED  MILITARY 

The  type  of  control  described  here  is  suitable  for  a  reheated  military  engine  and  its  future 
derivatives,  or  with  the  deletion  of  the  reheat  lane  a  complex  non-reheated  engine.  Fig.  10  shows  the 
overall  electronic  system  configuration.  The  dry  engine  control  comprises  two  identical  lanes,  either  of 
which  can  be  selected  by  the  pilot.  A  single  lane  of  reheat  is  provided.  The  only  areas  of  duplication  in 
this  latter  part  of  the  control  are  tiie  emergency  shut  down  logic  and  nozzle  close  and  reheat  cancel 
actuators. 


FIG.  10  Reheat  Configuration  FIG.  11  High  Integrity  Computor 

The  Advanced  Military  Control  uses  standardised  input/output  circuitry  in  common  with  the  other 
controls  described  in  this  paper,  but  has  one  unusual  feature.  This  is  the  high-integi :ty  computer  which 
is  shown  schematically  in  Fig.  11.  This  consists,  as  shown,  of  two  micro  processor  based  computers 
driven  by  a  common  deck.  Only  the  control  computer  can  send  command  signals  to  the  output  drives. 

Both  receive  identical  iniormation  via  serial  input  highways,  and  execute  identical  programs.  Outputs 
from  both  computers  are  compared  on  a  bit-by-bit  basis,  and  only  if  die  outputs  are  identical  to  this 
level  can  the  output  drives  be  enabled.  This  approach  provides  essentially  l''0%  monitoring  of  the  control 
computer  function. 

The  output  from  the  comparator  is  fed  to  a  block  of  circuitry  comprising  a  v'atchdog  timer,  fault 
integrator  and  initialisation  logic.  If  a  fault  condition  is  indicated  then  a  typical  resp  so  would  be:- 
Freeze  actuators,  Initialise  Computers,  Return  to  normal  operation  if  no  further  faults  o  -  ur .  If  fault 
condition  persists,  the  fault  integrator  will  initiate  lane  change  (dry  engine)  or  freeze  and/o,  shut  down 
(reheat). 

Thus  the  .advanced  Military  control  is  designed  to  depend  upon  its  self -monitoring  capability.  This 
is  essentially  because  it  has  been  conceived  from  the  beginning  as  a  fu>  1-authority  control  with  similar 
redundancy,  and  must  meet  stringent  integrity  targets.  Generally  speaking  the  requirements  ft »  dry 
engine  control  are  more  difficult  to  meet  in  practice.  For  example,  whereas  foi  a  dry  engine  tl  •' 
probability  of  a  failure  leading  to  reduction  or  loss  of  thrust  is  typically  defined  as  3  X  10"^  per  hour,  the 
corresponding  figure  for  failures  leading  to  reheat  extinction  is  3  X  10-4  per  hour.  Clearly  this  allows 
a  different  approach  to  configuring  the  reheat  controller  as  noted  in  Fig.  to  above. 


Jf 


Tiie  reheat  control  has  its  own  dedicated  transducers  for  parameters  not  available  from  the  dry 
engine  control  lanes.  Inputs  already  available  on  the  dry  engine  control  are  transmitted  in  serial  digital 
form  to  the  reheat  control,  thus  providing  diese  signals  more  reliably  than  a  set  of  simplex  dedicated 
transducers. 
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Industrial  Control 

In  addition  to  the  usual  gas  turbine  controls  for  governing,  temperature  control  power  control  etc. 
there  are  sequence  requirements  and  associated  with  both  a  large  display  requirement. 

Sequence  controls  in  this  context  are  defined  as  "the  outputting  of  signals  to  equipment  in  a 
pre-determined  sequential  order  according  to  the  condition  of  associated  equipment" .  The  process 
therefore  involves  monitoring  the  associated  plant  condition,  performing  various  tilling  and  logical 
functions  and  outputting  the  appropriate  commands.  In  addition  it  is  also  necessary  to  display  the  current 
sequence  state  and/or  the  reason  why  the  sequence  is  stopped  or  curtailed  in  the  case  of  a  fault  condition. 

A  typical  sequence  would  provide  for  say:  start  interlocks,  manual  start  and  run  up,  lubricating 
oil  pump  sequence,  fuel  pump  start  sequence,  starter  motor  control  sequence,  synchronising  sequence, 
loading  sequence,  shut  down  sequence. 


FIG.  12  Industrial  Sequence  &  Main  Control 

In  general  sequence  controls  are  dependent  on  the  application  and  each  with  different  specifications. 
Because  of  the  variability  the  digital  Modular  approach  shows  advantages.  Fig.  11  shows  a  typical 
arrangement  in  which  one  processor  is  dedicated  to  the  control  functions  and  the  other  to  the  sequencing. 
This  has  the  advantage  that  sequence  changes  can  be  incorporated  without  any  risk  of  affecting  engine 
control  performance.  The  interface  between  the  two  processors  is  via  the  I/O  highway. 

THE  HYDRO  MECHANICAL  ELEMENTS 

The  emphasis  so  far  has  been  on  the  electronic  aspect  of  controls  but  the  hydromechanical  side 
should  not  be  dismissed.  Obviously  even  with  the  most  'electronic  solution'  there  will  be  need  for 
pumps,  interfaces,  accurate  transducers,  shut  off  valves  and  distribution  systems  which  may  be  increased 
with  additional  valvery  to  cater  for  phased  or  sector  burning.  With  the  less  electronic  solution  -  the 
supervisory  or  manual  back  up  control  this  need  will  be  increased. 

The  progress  on  the  hydromechanical  elements  has  been  less  glamorous  but  still  steady  and 
purposeful.  On  fuel  pumps  steady  progress  has  been  made  to  accept  higner  temperature  fuel  (up  to  180  C), 
to  have  longer  life  (above  16000  hours) ,  to  run  with  greater  tolerance  with  dirty  fuel,  and  to  operate  with 
higher  efficiency  and  so  reduced  fuel  pumping  temperature  rise.  The  ability  to  operate  with  a  wider 
range  of  fuels  with  worse  lubricating  properties  is  also  being  pursued  as  well  as  the  antimisting  kerosene 
safety  fuels. 

ASSESSMENT  AND  FUTURE  APPLICATION 

In  the  first  AGARD  Power  Plant  Control  Symposium  held  in  1V74  a  description  was  given  of  a  complex 
digital  power  plant  control  (Ref.  l)  using  a  powerful  mini  computer.  Since  then  this  unit  has  flown  in  the 
Concorde  and  a  large  number  of  useful  lessons  have  been  learnt.  In  the  section  on  future  application  in 
the  early  paper  reference  was  made  to  the  emergence  of  the  micro  processor  and  the  profound  effsct  t!.,s 
would  have  on  controls.  In  the  present  AGARD  symposium  most  of  the  papers  deal  with  these  devices. 


If  W9  consider  the  first  generation  digital  engine  controls  as  comprising  of  the  mini  computer 
(say  1969  -  1975)  then  the  second  generation  must  surely  be  the  micro  processor  (say  1976  -  1985)  and 
it  is  of  interest  to  ask  whether  there  will  be  a  third  generation  and  how  it  wi.l  be  different- 

The  first  generation  was  successful  in  laying  the  foundation  for  the  circuits,  the  software,  the 
testing  and  in  proving  the  technical  feasibility  .  It  was  also  successful  in  changing  peoples  attitude  to 
digital  systems  and  provoking  interest.  With  h.ndsight,  and  being  critical,  it  failed  in  that  it  never  went 
into  production,  so  that  predictions  on  cost,  reliability  and  maintenance  costs  were  never  proved. 

The  second  generation  has  started  with  a  much  wider  area  of  application,  and  with  the  advantages 
of  reduced  cost  and  higher  reliability  components.  Every  attempt  has  been  to  modularise  and  to  reduce 
cost.  The  hydromechanical  interfaces  and  transducers  have  been  more  fully  researched.  The  second 
generation  should  be  successful  with  we  hope  few  problems. 

To  look  at  the  third  generation  when  the  second  hasn't  yet  achieved  production  service  may  appear 
optimistic,  but  there  are  two  good  external  pointers  to  the  future.  The  pointers  are  the  need  to  conserve 
fuel,  and  the  predicted  advances  in  the  semi  conductor  industry  with  the  growth  of  VLSI  (very  large  scale 
integration  with  100-20,000  circuits  per  chip),  and  perhaps  more  importantly,  the  increasing  use  and 
sophistication  of  the  micro  processor  in  the  automobile  industry. 

The  latter  will  result  in  reduced  cost  special  purpose  chips  and  a  "Control  system  on  a  chip" 
with  multiple  redundancy  may  be  possible.  The  concept  of  one  piece  of  hardware  for  any  application 
becomes  more  a  reality  where  all  possible  inputs  are  arranged  for  and  only  the  selected  number  for  the 
application  used. 

The  software  will  be  equally  important  with  more  emphasis  on  adaptive  solutions  and  less  settings, 
datums  and  slopes  required.  There  tvill  be  better  communication  with  the  pilot  or  the  management 
computer,  and  more  attempts  made  to  optimise  the  control  algorithms  with  perhaps  additional  engine  health 
functions.  The  hydromechanical  systems  will  be  simpler  and  the  transducers  more  accurate  and  reliable. 

CONCLUSIONS 

The  paper  has  attempted  to  show  how  the  control  industry  is  getting  nearer  to  the  concept  of  a 
general  purpose  control  and  how  common  modules  can  cover  a  range  of  applications  both  in  hardware  and 
software.  In  confirming  this  theme  examples  from  different  applications  have  been  shown  and  some 
prediction  made  for  the  future. 
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DISCUSSION 


V.Amoia,  It 

First  of  all,  thank  you  for  your  excellent  presentation.  I  am  not  asking  a  question,  but  just  a  comment:  As  far  as 
reliability  is  considered,  would  you  please  comment  on  the  use  of  fault  tolerant  architecture. 

Author’s  Reply 

We  make  extensive  use  of  standard  software  validation  techniques  to  check  input  and  output  signals.  Computer 
checking  includes  software  sumchecks  and  instruction  check  programs. 

Hardware  checking  is  particularly  based  on  the  use  of  the  computer  to  monitor  the  rest  of  the  system,  thus  special 
to  purpose  hardware  is  only  required  to  show  that  the  computer  is  working  satisfactorily.  The  level  of  this 
monitoring  depends  on  an  application  and  particularly  on  reliability  targets.  For  a  system  with  demonstrably  safe 
failure  modes,  as  with  the  use  of  limited  authority,  a  watchdog  timer  and  fault  integrator  is  quite  adequate.  For  a 
full-authority  duplicated  control,  or  even  a  simplex  one  in  the  case  of  reheat,  the  detection  of  computer  faults 
becomes  more  important  still,  and  is  best  accomplished  by  using  a  similar  computer  operating  synchronously  with 
the  control  computer.  In  this  case  a  simple,  reliable  comparator  provides  the  required  failure  detection  means. 
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1 .  INTRODUCTION 

Modern  eng  nes  will  be  controlled  by  digital  control  units.  Requirements  to  be  met  by 
the  digital  technology  and  the  advantages  resulting  therefrom  v_ll  be  pointed  out  in 
this  paper. 

Most  of  the  fuel  control  units,  generally  used  nowadays,  are  hydromechanical  ones.  They 
are  especially  characterized  by  their  high  rigidity  and  reliability. 

However,  due  to  limitations  of  weight  and  volume,  it  is  nearly  impossible  to  realize  in 
this  technology  complex  control  laws.-  The  introduction  of  electronical  control  units 
by  which  these  control  functions  can  be  realized  was  made  possible  by  the  operational 
amplifiers  on  an  analogue  basis.  In  addition,  by  this  it  was  possible  to  increase  the 
requirements  to  be  met  by  the  engine.  The  introduction  of  the  digital  technology  pro¬ 
mises  furtner  improvements  such  as  shorter  engine  acceleration,  a  better  and  easier 
adjustment  of  the  control  rules  to  individual  engines,  integrated  engine/flight  control 
and  exact  realization  oi  engine  characteristics. 


2.  STATE  OF  THE  ART 


Today  most  engine  control  units  are  still  developped  and  produced  on  a  hydromechanical 
basis.  Often  electronical  units  such  as  the  N1-limit  computer  of  the  engine  GE-CF6  at  the 
Airbus  are  superposed  on  these  control  units. 

There  is,  however,  already  a  number  of  electronical  control  units  -  mainly  analogically 
realized  -  where  the  main  fuel  system  is  still  designed  in  a  hydromechanical  way. 

Figure  1  shows  the  principle  structure  of  such  a  control  unit. 

It  has  to: 

carry  out  a  speed  control  for  the  high  pressure  compressor  by  means  of  electroni¬ 
cal  control  of  the  main  fuel  system  according  to  throttle  position, 

to  avoid  dangerous  modes  by  limiting  rotations,  accelerations,  and  turbine  -outlet- 
temperatures,  and 

to  concrol  nozzle  area  and  afterburner  fuel  flow. 

Besides,  the  concept  differs  from  the  conventional  hydromechanical  engine  control  units 
only  by  the  additional  N(j-limn:ation. 

From  this  you  can  see  that  in  the  present  electronical  control  units  for  multiple  spool 
engines,  too,  only  one  spool  is  controlled.  For  safety  reasons,  the  electronical  basic 
engine  control  units  are  realized  m  a  redundant  version  (  Fig. 2)  m  contrast  to  the 
hydromechanical  ones  (the  latter  include  an  emergency  system) . 

In  case  of  a  system  loss  of  the  electronical  control  unit  the  engine-shafts  will  be 
monitored  by  an  overspeed  governor  The  overspeed  governor  is  equipped  with  separate  sen¬ 
sors  and  it  limits  the  fuel  supply  for  the  engine. 


3 .  REQUIREMENTS 


The  requirements  to  be  met  by  a  digital  engine  control  unit  for  future  gas  turbines  will 
be  defined  based  on  the  experience  made  with  analog  engine  controi  units.  Among  the  re¬ 
quirements  specified  by  the  user  the  aspect  of  the  engine  handling  is  above  all  of  most 
importance.  For  example  a  fairly  linear  relationship  of  the  angle  of  throttle  and  thrust 
as  well  as  a  stable  engine  operation  in  all  ratings  and  in  the  whole  flight  range  are 
required. 

Further  requirements  are  mainly  determined  by  the  engine  and  the  aircraft. 

For  example  dangerous  engine  operating  conditions  (pumping,  overheating)  should  be  avoi¬ 
ded  by  limitation  of  relevant  engine  parameters.  The  requirements  determined  by  the 
engine  are  already  considered  to  a  satisfactory  degree  in  present  systems.  The  require¬ 
ments  called  for  by  the  user,  the  aircraft  and  its  equipment  will  have  to  be  taken  into 
account  much  more  when  developping  future  engine  control  units.  Especially  an  inter¬ 
action  between  engine  control  and  flight  guidance  system  is  required.  By  computing 
additional  data  of  flight  condition  and  disturbances  (e.g.  ',un  firing)  an  optimum  engine 
handling  also  during  extreme  maneuvers  as  well  as  an  optimum  steady  engine-state  in  the 
whole  flight  range  should  be  guaranteed.  The  safety  requirements  to  be  met  by  the  engine 
control  unit  have  an  essential  influence  on  the  realization  requirements  with  respect 
to  the  technical  equipment.  The  probability  of  loss  required  for  an  engine  control  unit 
should  be  less  than  10-^  per  hour.  This  value  can  be  achieved  by  a  duplex  system.  Pro¬ 
ceeding  the  assumption  that  future  aircraft  will  be  equipped  with  two  engines  and  that  it 
is  possible  to  fly  the  aircraft  with  one  controlled  engine  only,  the  total  probability 
of  failure  is  approximately  10-8  per  hour. 

Other  requirements  to  be  met  by  future  engine  control  units  relate  to  the  improvement  of 
the  testability  and  maintainability  and,  in  addition,  the  simplification  of  the  complex 
adjustment  of  the  control  unit. 

4.  ADVANTAGES  OF  A  DIGITAL  ENGINE  CONTROL  UNIT 

Based  on  some  examples  it  is  tried  to  demonstrate  the  possibilities  and  advantages  of 
the  digital  technics  which  are  specific  for  the  engine  control. 

4 . 1  Integrated  Engine  and  Flight  Control 

An  appropriate  interface  is  necessary  for  the  interaction  between  engine  control  unit 
and  flight  guidance  systems.  In  a  digital  realization  of  the  engine  control  unit  it  is 
possible  to  have  a  coupling  with  a  future  aircraft  data  bus.  By  means  of  this  coupling 
it  is  possible  to  read  in  data  e.g,  from  Air-Data-Computer  or  flight  control  system 
as  well  as  to  transmit  engine  data  to  the  engine-life-recorder,  flight  control  system 
or  display  system  (Fig. 3). 

4.2  Realization  of  functions 

The  representation  of  characteristics  may  be  rather  complex  m  an  analog  system  if  high 
accuracy  is  required.  For  the  realization  of  the  function  of  the  maximum  cruise  limitation 
line  of  the  fan  speed  for  the  CF6-engine  (fig. 4)  seven  reference  points  are  necessary  for 
the  required  accuracy  within  which  a  linear  interpolation  is  carried  out.  The  circuit 
necessary  for  the  characteristics  will  be  realized  on  one  IC-board  , 

In  a  digital  engine  control  unit  it  is  relatively  easy  to  represent  functions  with  high 
accuracy.  The  above  mentioned  engine  characteristic  is  realized  in  digital  technic  in  the 
N1 -limit-computer  of  the  Airbus  A300. 


The  complexity  of  this  realization  is  comparatively  small. 

There  are  two  possibilities: 

a)  Two  data  are  to  be  stored  for  each  reference  point.  A  linear  interpolation  is 
carried  out  within  these  points.  (Sub-program  with  30  statements); 

b)  the  curve  is  represented  by  a  function  of  n-th  degree.  In  this  example,  n  =  5 
(6  constants,  10  statements) . 

In  general  it  can  be  observed  that  with  a  minimal  supplementary  effort  any  accuracy 
may  be  achieved  by  the  digital  solutions.  The  results  of  a  digital  calculation  can  be 
reproduced.  The  c  .aracteristics  can  be  adjusted  by  reprogramming  with  respect  to  the 
actual  engine  mode.  In  contrast  to  this  in  an  analog  realization  the  accuracy  can  be 
lessened  e.g.  by  a  temperature  dependent  drifting. 

4.3  Reliability 

By  means  of  software  procedures  it  is  possible  to  detect  sensor  failures  and  defects 
occuring  in  the  hardware  of  a  digital  control  unit.  This  effect  can  be  used  for  the 
development  of  a  failure  self  detecting  engine  control  unit. 


4.3.1  Failure-self -detection  by  Software 

It  is  possible  to  detect  failures  in  the  hardware  of  the  control  ui.it,  i.e.  in  the  CPU 
memory  and  interface  by  means  of  special  built-in  test  programs.  They  are  processed  on 
line  in  the  intervalls  available  during  the  computing  cycles  of  the  control  unit. 

For  this  it  is  necessary  to  monitor  the  failure-self-detection  separately  in  a  super¬ 
visor  as  the  CPU  in  which  the  test  programs  are  executed  can  only  detect  failures  as 
long  as  it  is  functionally  in  order  (fig.  5) . 

To  realize  this,  the  CPU  has  to  reset  at  certain  intervals  a  timing  circuit  designed 
as  watch-dog-timer  in  the  supervisor;  otherwise  the  supervisor  reacts  as  in  the  case 
of  a  control  unit  failure  and  generates  a  switching  signal. 

By  supervising  the  engine  control  system  with  a  watch-dog-timer  and  software  procedu¬ 
res  to  test  CPU,  memory  and  standard  interface  it  is  possible  to  have  a  failure-de¬ 
tection  rate  of  95  percent. 

4 . 3 .2  Estimation  procedure  for  the  Sensor  Monitoring  (analytic  redundancy ) 

It  is  possible  to  monitor  the  sensors  and  the  analog  input  interface  by  means  of  esti¬ 
mation  procedures  for  the  sensor  values.  For  example  to  estimate  the  speed  of  the  high 
pressure  compressor  of  a  multiple  spool  engine  it  is  taken  advantage  of  the  fact  that 
there  is  a  definite  correlation  between  corrected  fuel  flow  and  compressor  speeds  for 
a  healthy  engine  (fig. 6)  . 

This  corrected  speed  is  determined  oy  a  simple  stationary  engine  model  using  besides 
other  parameters  the  measured  fuel  flow.  In  addition,  the  engine  dynamics  is  simulated 
m  a  simplified  way  by  a  variable  lag  type  filter  and  is  taken  into  account. 

A 

A  monitor/voter  is  fed  by  the  estimated  value  NH  and  the  signals  transmitted  by  the 
Nij  sensors.  The  monitor/voter  is  able  -if  necessary-  to  carry  out  a  majority  decision 
for  the  localization  and  elimination  of  a  failed  NH-sensor. 
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For  the  acceleration  or  deceleration  of  the  engine  the  estimation  error  is  less 
than  1  percent  if  the  engine  dynamics  is  taken  into  account  by  a  variable  lag  type 
filter.  Otherwise  estimation  errors  of  approximately  5  percent  would  occur  (fig. 7). 

In  a  steady  engine  state  estimation  errors  should  not  occur,  otherwise  they  are  caused 
by  design  tolerances  and  aging  of  the  engine.  However,  it  is  possible  to  eliminate 
these  errors  by  exactly  adapting  the  control  unit  to  the  engine. 

The  estimation  procedure  can  be  used  for  the  localization  of  a  sensor  failure.  On  the 
other  hand,  if  both  sensor  values  are  within  the  defined  monitor  threshold  limit  and 
the  software  sensor  determined  by  estimation  differs  considerably  from  the  consoli¬ 
dated  measuring  value,  it  is  possible  to  conclude  that  there  is  a  failure  in  the  analog 
output  interface,  main  fuel  system,  or  engine. 

Other  engine  sensors  such  as  speed  of  low-pressure  compressor,  temperatures,  pressures 
can  be  determined  with  %  and  Nh  in  an  appropriate  estimation  and  calculation  pro¬ 
cedure.  The  monitoring  is  made  in  accordance  with  the  procedure  previously  described 
for  NH. 

To  sum  up  it  can  be  said  that  it  is  possible  to  detect  and  localize  failures  in  the  con¬ 
trol  unit  including  the  analog  interface  as  well  as  in  the  sensors  by  means  of  the  soft¬ 
ware  procedures  described  for  the  failure-self -detection  and  state  estimation.  And  on 
certain  conditions  it  is  possible  to  assume  failures  being  present  in  the  main  fuel  system 
or  in  the  engine.  One  of  the  fundamental  advantages  offered  by  the  procedures  described 
for  the  failure-self-detection  is  seen  m  the  fact  that  they  can  also  be  used  for  pre- 
flight  tests  or  maintenance  work.  This  multiple  use  of  this  system  internal  intelligence 
results  in  an  improvement  of  testability  and  maintainability  of  the  control  unit. 

4.4  Adjustment  of  Control  Unit 

Various  engine  characteristics  are  mapped  in  the  control  unit  and  design  tolerances  m 
the  engine  affect  the  control  unit  quality.  Therefore  engine. control  units  have  to  be 
carefully  adjusted  to  the  corresponding  engine.  For  a  multi-shaft  engine  for  example, 
up  to  50  values  have  to  be  manually  adjusted  by  screws  or  potentiometers. 

In  a  digital  engine  control  unit  the  adjustment  of  the  control  values  to  the  individual 
engine  can  be  made  by  an  engine  test  run  on  line  via  a  digital  optimization  computer 
which  is  coupled  to  the  control  unit.  For  this  purpose  the  values  concerned  are  registered 
in  the  optimization  computer  memory  to  which  the  engine  control  unit  has  a  direct  access. 
After  t' ansmission  of  the  engine  input  values  to  the  optimization  computer,  an  automatic 
parameter  adaption  for  the  various  characteristics  can  be  made  via  the  appropriate 
strategies  and  the  characteristics  can  be  reprogrammed.  Today  this  reprogramming  is 
made  by  establishing  new  PROM  cards  (fig. 8),  which  are  then  exchanged  for  the  old  ones 
in  tne  control  unit.  Here,  on  line  reprogramming  of  the  control  unit  emerges  by  the  de¬ 
velopment  of  electrically  erasable  memories  for  micro  processors. 

5.  FEASABILITY 

Tests  carried  out  m  recent  years  showed  that  there  are  no  fundamental  problems  for  the 
digital  control  of  a  multiple  shaft  engine. 

It  has  been  proved  that 

sufficiently  exact  results  can  be  obtained  by  a  16-bit  fixed  point  data  processor, 

a  control  unit  sampling  rate  of  25  Hz  is  sufficient  for  the  speed  control  and 
limit  cycles  for  speed,  accelerations  and  temperatures,  and 
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converters  with  12  bit  resolution  can  be  used  for  the  analog  input/outputs. 


In  addition,  it  could  be  shown  that  today  it  is  already  possible  to  use  generally 
available  micro  processors  (SBP  9900  of  Texas  Instruments,  Intel  8086)  for  the  engine 


engine  control,  afterburner  control,  engine/ 


flight  control,  and  monitoring. 


Actually,  efforts  are  made  in  the  whole  world  concerning  the  development  of  high  ordered 
languages  (HOL) ,  to  be  used  in  cor*-rol  unit! .  (PEARL  in  Germany,  CORAL  66  -  England, 

ADA  -  future  standard  in  the  USA  ....).  This  enables  a  reduction  of  the  high  expendi¬ 
ture  made  for  coding  the  programs  which  is  still  normal  for  the  assembler  programming 
and  a  increased  reliability  of  the  software.  In  addition,  the  visibility  of  programs 
would  be  improved.  There  are  still  generally  accepted  procedures  to  be  elaborated  for 
the  specification,  test,  modification  and  maintenance  of  the  software  in  order  to  reduce 
costs  and  assure  a  higher  software  reliability. 


6 .  SUMMARY 

In  the  present  paper  it  could  be  shown  that  with  respect  to  their  capacity  future  digi¬ 
tal  engine  control  units  have  essential  advantages  (integrated  engine-flight  control, 
functions,  reliability,  adjustment)  compared  to  their  hydromechanical  and  analog  electro¬ 
nical  predecessors.  Digital  control  units  have  a  higher  efficiency  but  will  probably  be 
of  the  same  volume  than  actual  control  units,  as  nowadays  more  than  a  half  of  the  space 
available  is  needed  by  the  power  supply  and  the  analog  interface. 

A  considerable  reduction  of  the  interface  and  its  volume  will  only  be  possible  if  the 
environment  of  the  digital  computer  is  digitalized  as  well,  that  means  if  sensors  are 
provided  with  a  digital  pick-up,  and  if  a  d’rect  digital  control  of  the  actuators  and 
the  displays  is  available. 


18-6 


-v  '  ■'•vys' 


w$ w 


Fuel  Flow  Fuel  Flow 

Dry  Engine  Afterburner 


Nozzle- Area 


channel  1 


c 

<# 


s 

I 


Ciose  Loop  Coraroi 

— 

I 

nh 

Limitahon 

— 

ju 

]c 

Nh.Nh.Nl.T5I 

Switching  Logic  | 

Pilot  > 

_ j  channel  2 


Switching  Logic  | 

Limitation 

Ml 

Inlerfoce 

nH.Nh,Nl. 

Tst 

Close  Loop  Control 

_ 

nh 

NHmax  ^Lmax 


Afterburner 

Control 

Unit 


Nozzle 

Actuator 


Fuel  Flow 
Afterburner 


nh - 

Overspeed 

nl— 

Governor 

[stand  by 


by  pass 


Fue!  Flow 
Dry  Engine 


F]  g .  1 :  Structure  of  an  analog 
engine  control  unit 


Fig.  2:  Concept  of  a  redundant  electronical 
control  unit 
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Fig.  3:  Communication  between  the 

engine  control  unit  and  the 
flight  guidance  system. 


Fig.  4:  Realization  complexity  for 
characteristics 
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Sensors 


Fig .  5 ;  Failure-self-detection  in  a 
digital  control  unit 


Fig.  6:  Monitoring  system  for  the  high- 
pressure  compressor  speed  NH. 
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Fig.  8:  Automatic  control  unit 
adjustment . 
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DISCUSSION 


J.M. Collin,  Fr 

You  say  that  the  use  of  high  level  program  languages  involves  reliability  and  cost  reducing  factors. 

Please  comment  on  reliability  of  compilers  and  number  of  codes  in  comparison  with  assembler. 

D.J. Hawes,  Ca 

High  Level  Languages.  Could  you  please  give  your  opinion  of  the  pass-off  in  terms  of  software  programming  time, 
traceability,  reliability  and  hardware,  between  assembly  and  higher  level  languages,  e.g  Pascal. 

Author’s  Reply  (to  J.M.Collins  and  D  J. Hawes) 

We  expect  that  the  need  of  additional  storage  is  less  than  40%  for  the  programme-coding. 

But.  furthermore  1  2  k-words  are  needed  for  real  time  monitoring  system  and  runtime  software.  The  software 
reliability  will  increase  on  account  of  higher  visibility  of  HOL  source  programs. 


E. Roberts,  UK 

Clarification  Is  the  engine  model  an  on-line  model  (in  the  controlling  computer)  accurate  to  1%  during  transients? 
Author’s  Reply 

The  engine  model  is  on-line  m  the  controlling  computer  and  it  is  accurate  to  IT  during  transients  for  test  bed  runs 


N.A.Justice,  UK 

Correction  to  statement.  Suffiently  exact  results  can  be  obtained  with  8  bit  microprocessors  as  well  as  16  bit 
microprocessors. 

( 1 )  What  form  of  actual  hardware  do  you  have? 

(2)  What  type  of  microprocessoi  do  you  use'7 

(3)  Why  did  you  choose  that  type? 

Author’s  Reply 

We  have  different  development  projects  with  different  micropiocessors. 

( 1 6  bit  Texas  SBP  9900  and  Intel  8086: 

8  bit  Intel  8080/85). 

We  started  our  investigations  with  Intel  8080,  the  first  microprocessor  available  for  flight  purposes. 

Later  on  we  chose  the  successor  Intel  8085  and  on  account  of  accuracy  the'  16  bit  Intel  8086. 

For  military  investigation  the  SBP  9900  is  the  only  microprocessor  wit!.  MIL-standard. 


T .O’Brien,  UK 

Your  paper  states  that  or  a  two-engined  aeroplane  the  total  picjability  of  failure  due  to  malfunction  of  the  central 
system  is  10~8/hr.  Assuming  that  the  failure  can  be  hazardous  or  catastrophic  this  probability  is  totally  unaccept¬ 
able  for  electronic  engine  control  systems  in  civil  aeroplanes  The  Figure  would  have  to  be  at  least  two  orders  better,, 
i.e.  10^10.  Two-engine  failures  or  a  twin-engined  aeroplane  are  considered  catastrophic  and  as  engine  shut  down 
rates  from  all  causes  are  approximately  10^4  /hour  it  can  be  seen  that  the  proportion  allocated  to  the  electronic 
control  system  must  be  much  less. 

Author’s  Reply 

The  mos'  leliable  control  unit  is  unable  to  improve  the  reliability  of  the  engine. 

We  see  a  verification  of  a  total  probability  of  failure  due  to  malfunction  of  1 0  * 0  /hr  only  by  tripling  the  systems 


R.De  Hoff,  US 

,uoes  the  parameter  adaptivity  procedure  suggested  require  multiple  calibration  runs  of  the  engine  during  the  life 
of  the  engine? 


Uithor’s  Reply 

I  he  calibration  work  differs  from  engine  to  engine,  and  a  parameter  adaptation  ot  engine  and  control  unit  for  the 
first  flight  will  not  be  enough 
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THE  DIGITAL  CONTROL  SYSTEM  AS  PART  OF  AN  INTEGRATED 
ACCESSORY  FIT  FOR  FUTURE  ENGINES 


By:  M  P  Perks  and  T  G  Morton, 

Rolls-Royce  Limited,  Aero  Division, 
Leavesden,  Hertfordshire,  England. 


ABSTRACT 


The  paper  suggests  that  the  traditional  approach  of  designing  the  control  system  in  isolation  from  the 
other  accessories  on  a  gas  turbine  engine  may  not  provide  the  most  cost  effective  total  solution  for  an  en¬ 
gine  having  a  digital  control  system. 

It  is  considered  that  the  integrity  of  the  digital  control  can  be  maintained  whilst  providing  addition¬ 
al  functions  not  associated  with  its  prime  control  task.  This  could  allow  the  development  of  advanced 
monitoring  systems  to  minimise  life  cycle  costs  and  achieve  maximum  aircraft  utilisation. 

The  application  of  these  principles  to  helicopter  engines  is  discussed  and  an  arrangement  proposed 
which  could  provide  substantial  benefits  both  to  the  helicopter  pilot  and  to  the  ground  crew  Pilot  work¬ 
load  would  be  substantially  reduced  by  advising  him  of  engine  or  aircraft  management  factors  on  a  "need  to 
know"  basis.  Operators  would  benefit  from  regular  information  on  the  operational  status  of  the  engines. 


1 .  INTRODUCTION 


Electrical  control  of  gas  turbine  engines  has  been  an  accomplished  fact  for  over  30  years  with  control 
based  on  digital  computers  an  accepted  principle  for  at  least  the  last  10  of  these.  Recent  demonstrations 
of  the  virtues  of  full  authority  electrical  control  are  believed  to  have  provided  the  necessary  stimulus 
for  such  controls  now  to  be  seriously  considered  for  future  gas  turbine  engines  in  helicopters  world-wide. 

The  argument  as  to  whether  an  analogue  or  a  digital  based  system  would  best  satisfy  the  requirements  of  the 
particular  market  is  a  complex  one;  it  is  practically  certain  however  tint  future  military  engines  will  be 
conceived  from  the  outset  as  having  digital  control  systems.  In  the  military  field  the  trend  is  likely  to 
be  more  and  more  towards  treating  the  engine  as  a  subsystem  in  the  aircraft,  with  commands  transmitted  and 
reponses  received  along  redundant  data  highways  in  the  same  way  as  for  example,  an  air  data  computer. 

Digital  systems  generally  are  the  obvious  solution  for  such  aircraft. 

This  paper  does  not  set  out  to  resolve  the  analogue  versus  digital  question  for  the  helicopter  market 
but  is  intended  to  highlight  the  extended  capabilities  that  a  digital  control  can  confer  on  an  engine;  these 
capabilities  have  obvious  benefits  in  the  military  field  and  it  is  contended  that  such  advantages  should  be 
made  use  of  more  generally.  In  defining  the  advantages,  one  should  start  by  asking  the  question  "What  is 
the  prime  function  of  the  helicopter,  and  what  role  does  the  pilot  play  in  the  achievement  of  this  objective?" 
It  is  clear  that  the  aircraft  does  not  exist  to  transport  the  powerplant  around  and  that  the  pilot  has  other 
things  to  do  than  look  after  the  engine. 

These  apparently  self  evident  facts  are  often  overlooked  and  if  taken  to  their  logical  conclusion 
imply  that  the  engine  should  be  a  fit  and  forget  component. 

It  is  interesting  to  note  the  differences  in  approach  evident  in  two  recent  flight  test  evaluations 
carried  our  by  a  leading  U.S.  aerospace  journal,  one  of  the  latest  fly-by-wire  single  engined  fighter  and 
the  other  of  a  new  civil  helicopter.  The  former  report  hardly  mentions  the  engine  at  all;  the  latter  con¬ 
tains  extensive  sections  on  engine  starting,  operating  limits,  gas  generator  speeds  etc.  Which  approach 
ought  to  be  the  one  for  the  future? 

Being  realistic,  the  fit  and  forget  philosophy  implies  quite  a  complex  engine  monitoring  system,  since  it 
is  very  unlikely  that  powerplant  reliability  could  in  itself  be  adequate.  If  it  were  then  no  doubt  advantage 
would  be  taken  to  extend  life,  power  etc.,  and  we  are  back  to  where  we  started.  Engine  health  monitoring  is 
again  not  a  new  concept  and  in  fact  has  been  an  accepted  aspect  of  the  operations  of  large  airlines  for  many 
years.  Of  necessity  customers  in  the  helicopter  market  have  kept  these  systems  as  simple  as  possible  in  line 
with  the  operational  activities  of  the  aircraft.  These  operational  requirements  are  becoming  increasingly 
complex  as  the  capabilities  of  new  helicopters  are  exploited.  Some  operators  now  utilise  limited  aircraft 
management  avionic  systems  to  maximise  use  of  the  helicopter  and  reduce  the  overall  cost  of  ownership,  tne 
ready  acceptance  of  the  value  of  such  avionics  indicating  surely  that  the  market  is  ready  for  an  increasing 
level  of  automatic  system  involvement  in  the  general  flight  operation  of  the  aircraft. 

This  paper  therefore  proposes  that  digital  control  should  be  marketed  on  a  more  positive  basis  such 
as  "It  controls  the  engine,  of  course,  but  it  also  provides  additional  capabilities  which  no  modern  aircraft 
should  be  without."  It  is  suggested  that  the  approach  most  likely  to  prove  attractive  to  potential  aircraft 
operators  is  one  where  there  is  a  significant  level  of  integration  of  the  control  with  a  total  engine  and 
aircraft  monitoring  system.  The  overall  capabilities  of  one  such  integrated  arrangement  are  described  in 
this  paper  and  the  potential  operational  advantages  surveyed. 


2.  CONTROL  SYSTEM  DESIGN 


Many  possible  electronic  control  systems,  both  analogue  and  digital,  have  been  described  in  technical 
literature  over  the  last  few  years,  one  example  being  given  in  reference  1.  There  is  no  one  "right  way"  to 
control  a  gas  turbine  engine,  many  qu.te  different  approaches  having  been  adopted  to  starting  schedules, 
acceleration  laws,  temperature  limiting  etc:  what  may  be  suitable  for  one  engine  may  be  unsuitable  for 
another.  Further,  control  laws  lending  themselves  readily  to  a  hydromechanical  solution  may  be  difficult 
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to  implement  within  an  electrical  system  and  vice  versa# 

In  this  paper  we  are  not  concerned  so  much  with  engine  control  per  se.,  more  with  the  form  of  its 
interface  with  the  rest  of  the  aircraft,  and  in  particular  with  the  pilot.  It  is  in  the  interface  areas 
where  the  benefits  of  digital  control  as  opposed  to  analogue  can  become  most  readily  apparent,  and  where 
the  deficiencies  of  current  hydromechanical  arrangements  are  most  marked.  There  are  basically  two  main 
interfaces  in  any  aircraft  between  the  pilot  and  the  engine,  that  resulting  from  his  direct  link(s)  with 
the  engine  control  system  and  that  associated  with  engine  monitoring  i.e.  instrumentation.  Both  the  pilot 
and  the  control  system  currently  use  essentially  the  same  engine  data  to  perform  their  respective  tasks 
although  additional  information  may  be  provided  to  the  pilot  for  purposes  outside  the  normal  scope  of  the 
control  system,  for  example,  oil  system  monitoring. 

This  being  so,  it  would  seem  reasonable  to  suggest  that  if  the  digital  protagonists  are  right  and  there  is 
computing  power  to  spare,  the  digital  control  could  undertake  some  of  the  engine  monitoring  functions  itself, 
thus  significantly  offloading  the  pilot.  Once  this  is  accepted  the  whole  concept  of  the  man/machine  inter¬ 
face  may  be  re-evaluated  against  a  new  set  of  ground  rules  where,  assuming  integrity  is  safeguarded,  the 
main  requirement  is  to  make  flying  the  aircraft  easier. 


3.  MAN/MACHINE  INTERFACE 
3.1  Use  of  Interface 


Any  aircraft  would  require  a  number  of  functions  to  be  performed  relating  to  the  operation  of  its 
power  plant  and  associated  systems.  These  functions  may  be  listed  as  follows:- 

(a)  Select  the  engine  operating  condition  required. 

(b)  Monitor  the  health  of  the  engine  and  its  control. 

(c)  Monitor  the  use  of  the  engine. 

(d)  Ensure  that  engine  operation  is  within  cleared  limits. 

(e)  Fly  the  aircraft  to  within  its  cleared  limits, 

(f)  Control  the  engine  directly  when  necessary. 

Performance  of  each  of  these  functions  is  affected  by  the  form  of  the  man/machine  interface.  Tradi¬ 
tionally  the  necessary  transfer  of  information  between  the  pilot  and  the  engine  has  been  achieved  by 
a  mechanical  link  between  the  pilot  and  the  control  system  to  transmit  demands  to  the  engine  for  nor¬ 
mal  and  direct  (reversionary)  control,  and  a  display  of  information  on  engine  operating  conditions  on 
standard  instruments  using  electrical  signals  derived  from  engine  transducers.  Fig.  1  illustrates  a 
typical  modem  helicopter  cockpit. 


FIGURE  1  -  TYPICAL  HELICOPTER  COCKPIT 


A  more  appropriate  electrical  version  of  the  "mechanical  reins"  to  meet  functions  (a)  and  (f)  is  dis¬ 
cussed  below.  Arguably,  (b) ,  (c)  and  (d)  could  be  performed  automatically  provided  that  the  configur¬ 
ations  of  the  systems  ensures  adequate  integrity.  These  tasks  fall  into  the  general  category  of  "con¬ 
trol  and  engine  monitoring"  and  therefore  will  be  examined  later  in  relation  to  the  broader  issues  of 
health  monitoring  as  applied  to  helicopter  engines,  see  para.  4.  Aspect  (e)  is  essentially  a  total 
aircraft  function  and  therefore  involves  additional  information  about  specific  airframe  parameters; 
to  accept  this  as  a  candidate  for  automatic  monieoring  involves  an  extension  to  a  total  aircraft  t  ni- 
toring  approach.  Function  (f)  requires  a  limited  amount  of  engine  performance  information  but  other 
wise  may  be  considered  as  directly  influenced  by  the  prime  function  (a). 


3.2  Future  Form  of  Control  Interface 


The  logical  consequences  of  an  electrical  control  approach  is  that  control  information  between  the 
pilot  and  the  engine  should  be  transferred  in  the  form  of  electrical  signals.  To  maintain  control 


integrity  a  backup  path  for  control  demands  must  also  be  provided:  this  could  take  the  form  of  the 
traditional  mechanical  solution  but  it  is  considered  that  an  alternative  offering  adequate  integrity 
together  with  reduced  pilot  workload  would  also  be  by  independent  discrete  electrical  signals.  The 
resultant  system  has  many  installational  and  operational  advantages,  its  main  disadvantage  being  a 
deep-rooted  suspicion  in  the  minds  of  many  people  that  in  the  event  of  a  major  problem  the  electrical 
wire  would  let  them  down. 

There  is  no  real  answer  to  this  except  to  say  that  if  a  whole  aircraft  can  be  designed  around  a  fly- 
bywire  concept  then  the  small  step  of  engine  control-by-wire  should  appea.  relatively  trivial.  An¬ 
other  "anti"  lobby  argues  the  potential  effects  of  electromagnetic  interference:  there  is  no  doubt 
you  have  to  be  careful  here  but  in  3  million  hours  of  Rolls-Royce  Gnome  engine  operation  in  civil  and 
military  helicopters  with  full  authority  electrical  control  (admittedly  not  digital)  there  has  not  been 
one  instance  of  this  sort  of  problem  -  and  with  long  airframe  leads  carrying  relatively  low  level 
transducer  signal...  The  Gnome  in  its  military  role  has  operated  perfectly  safely  off  the  decks  of 
airciafc  carriers  carrying  extremely  powerful  radar  and  radio  systems.  The  still  sceptical  reader 
should  also  note  two  further  facts  about  the  Gnome  control,  firstly  it  draws  power  from  the  aircraft 
bus  only  and  secondly  in  one  civil  application  it  was  not  considered  necessary  to  include  reversion 
at  all  -  FIGURE  2, 


FIGURE  2  -  WESTLAND  WESSEX  (FLY-BY-WIRE 
ENGINE  CONTROL) 

Assuming  then  that  engine  control  is  by  electrical  signals  and  that  these  signals  are  commanding  the 
engine  through  a  digital  control  system,  a  panel  for  a  twin  engined  helicopter  as  shown  diagrammatic- 
ally  in  Figure  3  can  be  envisaged. 


FIGURE  3  -  FUTURE  FORM  OF  CONTROL  INTERFACE  (TWIN  ENGINED  HELICOPTER) 

The  operation  of  the  control  panel  would  be  as  follows :- 
2 . 1  Computer  On-Off  Select 

The  digital  control  requires  a  28V  power  supply  which  must  be  selectable  on  or  off  for:- 

(a)  Ground  check  purposes, 

(b)  control  below  ground  idle  conditions,  assuming  an  efficiently  sized  self  powered  generator  is 
fitted, 

(c)  direct  pilot  control  of  the  engine,  assuming  this  is  an  electrical  rather  than  a  mechanical 
system,  and 


(d)  as  a  back-up  supply  in  the  event  of  a  self  generated  power  failure. 


This  is  to  allow  a  "go  -  no  go"  test  of  the  control  prior  to  engine  start  as  an  additional  check  to 
the  normal  in-flight  self  monitoring  routine  to  check  out  normally  dormant  engine  controls  such  as 
frc:  turbine  overspeed.  The  pre-flight  check  should  not  require  any  ground  test  equipment. 

3.2.3  Engine  Start/Ground  Idle  Select 

Preferred  engine  start  procedures  may  involve  pre-selection  of  ground  idling  conditions  and  then 
initiation  of  engine  start  via  the  appropriate  starter  and  ignition  switches. 

There  may  be  some  advantages  in  integrating  the  engine  control  with  aircraft  starter  and  ignition 
circuits  to  provide  a  simpler  engine  start  procedure. 

3.2.4  Flight  Select 

The  transition  from  ground  idle  to  the  flight  condition  (i.e.  governed  at  or  near  100Z  speed)  could, 
in  isolation  from  consideration  of  aircraft  rotor  characteristics,  be  controlled  automatically  on 
pilot  selection  of  the  flight  mode.  The  transition  could  be  made  to  a  schedule  combining  any  of  the 
parameters  existing  within  the  computer.  An  automatic  transition  would  be  applicable  to  the  engine 
not  associated  with  running  up  the  aircraft  rotor. 

For  the  engine  controlling  the  rotor  run-up  full  pilot  control  of  the  rotor  speed  at  all  times  is 
considered  essential.  Associated  with  each  engine  should  therefore  be  a  "fly"  select  control  for 
automatic  transition  from  ground  idle  to  NF  governing,  but  for  the  rotor  run-up  engine  operation 
during  the  transition  should  be  via  an  effective  rotor  speed  control  lever. 

Where  a  separate  accessory  driving  mode  is  required,  a  logic  interlink  between  the  engine  controls 
and  th*  selectable  freewheel  is  proposed  to  replace  the  conventional  condition  lever  microswitches 
to  provide  a  simple  safe  selection  procedure.  The  logic  would  require  acceptable  levels  of  speed 
signals  before  enabling  freewheel  actuation. 

3.2.5  Reversionary  Control  Select 


The  optimum  arrangement  for  direct  pilot  control  of  the  engine  is  considered  to  be  where  each  engine 
control  system  is  designed  to  fail  frozen  and  to  warn  the  pilot  that  a  fault  condition  exists.  The 
options  then  open  to  the  pilot  are  to  leave  the  engine  in  the  frozen  state  and  rely  on  the  power 
modulation  available  from  the  "good"  engine  for  rotor  speed  control,  to  shut  the  failed  engine  down 
or  to  reset  the  power  level  of  the  frozen  engine.  Such  a  reset  of  the  engine  condition  may  be  done 
most  conveniently  through  a  beeper  switch  arrangement,  preferably  on  the  collective  pitch  lever. 

3.2.6  jSh’  -  Down  Select 

It  must  be  possible  for  the  pilot  to  select  shut  down  from  any  operating  condition  though  normally 
shut  down  would  only  be  initiated  from  ground  idle.  Two  separate  means  of  shutting  off  the  engine 
fuel  flow  should  be  provided  in  the  engine  fuel  delivery  lines  for  fire  zone  precautions. 

3.2.7  Super  Contingency  Select 

A  "super  contingency  select"  facility  could  be  required  in  some  cases,  the  intention  being  to  allow 
the  pilot  to  raise  the  normal  contingency  limits  restricting  engine  power  to  higher  levels  for  emer¬ 
gency  use  in  the  aircraft.  A  single  manual  selection  of  super  contingency  for  all  engines  is  assumed; 
it  is  worth  noting  that  the  initiation  of  the  condition  could  be  automatic,  using  perhaps  an  aircraft 
low  rotor  speed  signal. 

3.3  Monitoring  Interface 


Provided  that  the  power  plant  is  perfectly  healthy,  that  it  is  being  operated  within  its  cleared 
limits  and  is  not  within  a  time  restricted  domain,  the  pilot  does  not  need  to  know  any  information  on 
engine  conditions  at  all.  At  other  times,  the  pilot  is  a  very  inefficient  engine  monitor,  particularly 
under  failure  conditions  where  the  odds  are  he  is  not  looking  at  the  relevant  instrument(s)  at  the 
instant  of  the  fault  developing  and  relies  on  training  and  instinct  to  do  the  right  thing.  It  is  more 
likely  that  he  will  detect  faults  by  physically  sensing  a  change  in  his  environment  or  by  his  atten¬ 
tion  having  been  attracted  by  warning  lights  etc.  A  recent  incident  has  even  demonstrated  that  given 
an  adequate  power  margin  and  a  sufficiently  responsive  good  engine,  he  may  not  even  notice  such  a 
major  event  as  a  complete  engine  flame  out.  Peihaps  as  a  monitor  of  gradual  change  the  pilot  is  more 
effective,  but  unless  the  situation  is  relatively  straightforward  (such  as  slowly  falling  oil  pressure) 
the  likelihood  is  that  his  decisions  as  to  actions  to  take  may  not  be  arrived  at  easily  -  which  implies 
a  high  diagnostic  workload.. 

It  has  been  mentioned  already  that  the  digital  control  can  aid  the  pilot  by  carrying  out  some  limited 
monitoring  functions  since  it  uses  similar  engine  information  to  that  displayed  to  the  pilot.  This 
is  the  point  where  control  functions  and  functions  previously  restricted  to  "engine  health  monitoring” 
systems  begin  to  be  seen  as  overlapping.  The  form  of  the  interface  here  is  less  contentious  than  that 
for  the  control  -  surely  simple  lights  are  acceptable?  It  is  envisaged  that  fault  conditions  n^t  re¬ 
quiring  immediate  pilot  action  would  be  indicated  by  an  amber  warning  with  further  information  av< un¬ 
able  through  an  automatic  display  facility.  The  more  serious  faults  would  be  signalled  by  a  red 
warning  on  a  central  warning  panel,  with  unambiguous  indication  of  what  the  fault  was. 


The  extent  to  which  additional  hardware  beyond  that  needed  for  the  control  task  is  required  t.u  -he 
monitoring  depends  on  the  power  of  the  basic  computer,  the  parameters  used  for  control  •u.u  tl  x  con- 
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figuration  of  the  interface.  If  the  task  is  accepted  from  the  outset  .hen  the  system  can  be  designed 
to  be  compatible  with  the  following  monitoring  without  significant  per.alty:- 

3.3.1  Control  Monitoring 

As  part  of  a  normal  self  checking  routine  the  computer  would  essentially  monitor  all  the  control 
system  equipment  and  should  detect  system  faults  (e.g.  loss  of  a  control  signal  or  a  faulty  drive 
motor)  as  well  as  faults  within  itself.  Not  all  of  these  faults  will  necessitate  losing  the  whole 
system,  for  example,  loss  of  a  thermocouple  used  for  a  temperature  limiting  function  need  not  affect 
the  normal  operation  of  the  control. 

3.3.2  Limit  Exceedence 


Engine  ratings  are  determined  by  speed,  temperature,  torque  (power)  etc.,  levels  beyond  which  engine 
operation  is  time  restricted  for  lifing  and  certification  reasons.  The  observance  of  ratings  below 
maximum  contingency  is  generally  a  pilot  function  and  can  involve  a  significant  workload  since  under 
different  ambient  conditions  different  parameters  may  be  the  rating  limiting  feature.  For  example 
an  engine  which  may  be  temperature  limited  "hot  and  high"  may  be  speed  limited  at  sea  level  ISA  and 
may  be  torque  limited  under  cold  conditions .  For  this  reason,  and  the  fact  that  time  may  be  very 
important  and  therefore  high  powers  may  be  demanded  to  accomplish  the  mission  quickly  irrespective  of 
engine  or  even  airframe  limitations,  strict  observance  of  limits  may  be  rather  neglected.  No  monitor¬ 
ing  system  can  prevent  purposeful  misuse  of  course,  but  unintentional  exceedence  <  f  limits  can  be 
reduced  by  improving  the  monitoring.  The  exceedence  of  rating  conditions  can  simply  be  determined  by 
the  control  computer  by  a  suitable  programme  addition  and  the  information  relayed  to  the  pilot  in  an 
unambiguous  manner  by  annunciator  lights,  with  usage  of  the  engine  being  appropriately  recorded. 

Other  engine  limits  such  as  vibration  levels,  oil  pressures  and  oil  temperatures  can  also  be  monitored 
by  the  computer  and  an  indication  given  of  limit  exceedence.  These  parameters  would  require  an  exten¬ 
sion  of  the  computer  hardware  and,  in  the  case  of  vibration  monitoring,  probably  external  transducer 
processing. 

3.3.3  Engine  Failure 

Although  the  prime  requirement  here  is  to  detect  run  down  situations,  the  control  cannot  really  be 
relied  on  for  this  since  many  of  these  faults  may  be  caused  by  the  control  itself.  It  is  possible 
however,  to  provide  limited  failure  warning  indication  via  the  control  computer  by  detecting  such 
fault  conditions  ass- 

(a)  Excessive  temperature  for.  a  given  speed 

(b)  low  engine  power  at  a  given  temperature 

(c)  mismatch  between  spool  speeds  on  a  multi-shaft  engine 

(d)  unusual  response  during  transient  conditions,  e.g.  inconsistent  rates  of  change  of  speed, 
temperature  3nd  torque  with  fuel  flow  change. 

3.3.4  Engine  Usage 

As  a  background  task  for  the  control  computer,  a  monitor  of  critical  engine  usage  (low  cycle  fatigue, 
high  cycle  fatigue  and  creep  life)  can  be  piovided  with  data  storage  for  subsequent  readout.  The 
definition  of  how  these  parameters  are  derived  is  beyond  the  scope  of  this  paper,  but  apart  from 
being  of  interest  to  engine  stressmen,  engine  usage  monitoring  can  pay  dividends  in  cost  oc  ownership 
terms.  Ultimately  engines  may  be  released  without  lives  as  such  -  overhauls  being  undertaken  as  and 
when  necessary  as  judged  by  the  usage  of  th?  fatigue  cycles  of  critical  components.  Whereas  a  reason¬ 
able  basis  exists  for  such  life  assessment  on  fixed  wing  scheduled  airline  services,  using  the  opera¬ 
tional  pattern  of  the  aircraft,  helicopters  have  no  similarly  predictable  characteristics  and  bearing 
in  mind  the  virtual  impossibility  of  pilot  evaluation  of  the  fatigue  cycles  then  an  automatic  monitor¬ 
ing  system  here  would  certainly  be  worthwhile. 

3.4  Future  Form  of  Monitoring  Interface 

The  pushbutton  control  interface  described  in  para.  3.2  and  shown  on  Figure  3  can  be  extended  to  in¬ 
clude  the  monitoring  performed  by  the  basic  control  as  shown  on  Figure  4.  The  annunciation  of  control 
faults  is  via  a  red  warning  of  "freeze"  on  the  warning  panel  (or  of  "fail"  if  a  rundown  situation 
exists)  together  with  an  amber  on  the  control  panel  for  degraded  control  faults.  Limit  exceedence 
monitoring  is  indicated  by  amber  rating  lights  on  the  control  panel:  other  parameters  such  as  vibra¬ 
tion  exceedence  would  require  an  extension  to  the  indicating  system.  The  limited  engine  failure  de¬ 
tection  capability  of  the  control  would  also  signal  the  pilot  through  the  red  "fail"  on  the  warning 
panel . 

To  obtain  engine  usage  information  from  the  control  would  require  either  ground  based  test  equipment 
or  some  form  of  built-in  interrogation  arrangement.  This  latter  represents  a  significant  addition  to 
the  monitoring  system  which  really  becomes  attractive  only  when  its  capabilities  are  utilised  for  more 
than  usage  information  readout. 
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FIGURE  4  -  CONTROL  +  LIMITED  MONITORING  INTERFACE  (TWIN  ENGINED  HELICOPTER) 

3.5  Extended  Capability  Control/Monitoring  Interface 

Figure  5  shows  a  functional  form  of  interface  not  only  allowing  readout  of  monitoring  data  but  also 
entry  of  data  for  both  control  and  monitoring  purposes.  It  should  be  emphasised  that  Figure  5  is 
diagrammatic  only  and  chat  the  actual  form  of  the  console  would  need  to  be  designed  to  be  compatible 
with  the  overall  cockpit.  A  simpler  arrangement  restricting  the  number  of  pushbuttons  on  the  facia 
could  well  be  feasible,  as  could  more  advanced  display  systems  such  as  cathode  ray  tubes.  These 
latter  would  allow  the  simultaneous  display  of  several  different  parameters  in  digital,  analogue  or 
even  graphical  form,  the  actual  display  depending  on  the  monitoring  function. 
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FIGURE  5  -  ADDITIONAL  CONTROL/MONITORING  INTERFACE 

The  readout  capability  can  make  available  on  interrogation  recorded  usage  data  and  also  diagnostic 
information  following  the  detection  by  the  control  computer  of  fault  conditions.  In  addition  pilot 
cues  for  system  checkout  could  be  provided,  as  could  an  accurate  readout  of  the  value  of  a  number  of 
selected  parameters  (speeds  etc.)  if  required. 

Although  the  use  of  digital  techniques  overcomes  to  a  large  extent  the  necessity  for  external  adjust¬ 
ments  of  offset,  datum  drift  etc.,  there  may  still  be  the  necessity  to  set  up  the  control  to  match 
specxt>  engine  or  aircraft  characteristics.  The  accessibility  required  of  these  adjustments  and  the 
for_  they  should  take  may  be  the  subject  of  considerable  debate,  but  it  is  considered  that  the  data 
recovery  facility  would  communicate  with  the  engine  control  computer  via  a  oata  highway  and  therefore 
the  addition  of  limited  authority  adjustments  to  the  control  may  be  implemented  using  the  same  high¬ 
way  and  a  data  entry  panel. 

The  general  configuration  of  the  interface  can  now  be  seen  as  capable  of  allowing  detailed  information 
to  be  output  from  a  more  comprehensive  system  dedicated  to  monitoring  the  overall  engine  health  and 
performing  some  general  aircraft  management  functions.  Such  a  total  aircraft  health  monitoring  system 
can  have  many  important  benefits  both  to  the  pilot,  the  ground  crew,  and  last  but  by  no  means  least, 
the  aircraft  operator. 


4,  TOTAL  AIRCRAFT  HEALTH  MONITORING  SYSTEM 


Though  possibly  only  part  of  an  even  more  comprehensive  aircraft  system,  the  scope  of  this  paper  onJy 
allows  consideration  of  essentially  the  engine  -  related  features  of  an  aircraft  health  monitoring  arrange¬ 
ment.  The  objectives  here  can  be  stated  as:- 

-  Reduction  of  operating  CLists  by  providing  the  ground  crew  with  appropriate  data  to  take  timely  mainte¬ 
nance  action,  avoiding  unnecessary  work. 


Improvement  of  engine  operating  lives  by  accurately  monitoring  cumulative  damage  to 
critical  components. 
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-  Reduction  in  aircraft  downtime  by  assisting  in  the  diagnosis  of  engine  and  control  malfunctions, 
including  those  caused  by  engine  mechanical  or  aerodynamic  deterioration. 

-  Reduction  of  pilot  workload  in  flight  by  automatic  monitoring  of  the  engine  and  its  control. 

-  Enhancement  of  the  mission  capabilities  of  the  aircraft  by  providing  pilot  data  relating 
to  aircraft/engine  performance  on  a  "need  to  know”  basis. 

Not  all  operators  would  require  or  at  least  would  be  prepared  to  pay  for  such  comprehensive  capabilities 
and  therefore  to  achieve  the  various  levels  of  monitoring  appropriate  to  each  customer  a  modular  system 
is  desirable.  We  have  seen  that  when  engines  are  fitted  with  digital  control  some  levels  of  monitoring  can 
be  incorporated  within  the  basic  control  unit.  As  the  complexity  of  health  monitoring  is  increased,  a  point 
will  be  reached  where  it  is  more  beneficial  to  acquire  the  data  and  output  it  for  processing  separately. 

The  detail  configuration  of  the  total  system  must  be  a  compromise  between  engineering  and  commercial  press¬ 
ures,  and  this  is  where  the  advantages  of  the  integrated  control  and  monitoring  approach  become  most  apparent 
since  completely  separate  control  and  monitoring  systems  implies  some  duplication  of  both  function  and  hard¬ 
ware.  A  certain  amount  of  this  may  be  inevitable  to  achieve  the  right  levels  of  integrity  but  there  are 
areas  (such  as  the  cockpit  interface)  where  the  two  systems  naturally  come  together  and  where  integration 
can  be  more  cost  effective. 

The  total  health  monitoring  system  is  therefore  envisaged  as  the  basic  digital  control  computers  performing 
limited  monitoring  tasks  as  described  and  communicating  information  to  the  pilot  via  the  monitoring  inter¬ 
face,  together  with  microprocessor  based  data  acquisition  units  providing  information  to  a  separate  health 
monitoring  central  processing  unit  (CPU)  which  also  communicates  with  the  pilot  through  the  interface. 

Figure  6  shows  diagrammatically  the  system  configuration:  the  control  systems  may  be  considered  as  operating 
in  parallel  with  the  data  acquisition  units  and  providing  additional  data  to  them. 
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FIGURE  6  -  INTEGRATED  TOTAL  HEALTH  MONITORING  SYSTEM 

With  urgent  casks  such  as  limit  exceedence  being  undertaken  by  the  digital  control,  the  health  monitoring 
dedicated  CPU  can  even  out  its  logic  and  computation  workload,  thus  allowing  a  modest  size  of  unit  which 
can  be  maintained  at  a  high  utilisation  level.  The  CPU  would  be  connected  to  both  engine  and  aircraft  data 
sources,  the  monitoring  interface  and  a  data  silo  using  suitable  data  highways  with  the  necessary  isolation 
for  irtegricy. 

Basic  integrity  of  the  system  can  be  further  assured  using  CPU  self  checking  procedures  similar  to  those 
used  for  control,  with  a  limited  amount  of  duplicated  processing  for  critical  parameters  carried  out  within 
the  digital  control.  This  ensures  retention  of  vital  data  in  the  event  of  a  system  fault  and  also  allows 
the  next  logical  stage  in  the  evolution  of  the  total  health  monitoring  concept  to  be  considered,  namely  -he 
removal  of  current  pilot's  monitoring  instrumentation  altogether  and  the  substitution  of  fully  automatic 
monitoring  together  with  a  display  on  demand  of  "essential"  data.  The  operation  of  the  total  health  monitor 
ing  system  against  the  objectives  stated  earlier  would  be  as  follows. 

A . 1  Maintenance  Data  for  Ground  Crew 


Information  concerning  the  engine  behaviour  since  the  last  maintenance  activity  (general  deterioration 
and  health,  life  usage,  oil  or  fuel  system  maintenance  etc.)  can  be  recovered  either  from  alterable 
non-volatile  read  only  memory  within  the  system,  using  the  cockpit  data  display  for  routine  mainte¬ 
nance,  or  from  the  data  silo  using  ground  based  equipment  in  the  event  of  a  major  problem. 
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4.2  Engine  Usage 

Low  cycle  fatigue  and,  where  relevant,  high  cycle  fatigue  ana  creep  life  would  be  recorded  and  the 
relevant  information  made  available  for  scheduling  of  aircraft  maintenance  or  operational  activities. 
Where  on-going  operation  of  the  engine  depends  on  the  continuing  accuracy  of  this  data  (i.e.  the 
engine  is  released  on  a  usage  basis  rather  than  with  a  defined  life  in  hours)  then  separate  records 
may  be  kept  in  the  control  computer  and  in  the  health  monitoring  CPU. 

4.3  Engine  Defect  Diagnosis 

Assuming  no  major  engine  malfunctions  occur,  any  deterioration  of  performance  or  increase  in  vibra¬ 
tion  will  be  slow.  It  is  therefore  necessary  to  take  sample  trend  data  during  each  flight  which  would 
be  passed  to  the  data  silo.  This  will  allow  the  ground  station  to  look  at  trends  over  a  long  period 
and  ascertain  wnen  irregularities  are  occirring.  On-board  processing  of  the  information  as  a  post¬ 
flight  task  would  be  possible  though  incurring  a  hardware  penalty.  The  subsequent  display  of  meaning¬ 
ful  trend  data  from  the  processing  would  probably  only  be  possible  using  a  cathode  ray  tube  display  as  a 
pilot/ground  crew  interface. 

Careful  monitoring  of  trend  patterns  can  often  highlight  a  potential  defect  in  the  early  stages,  thus 
aiding  maintenance  forward  programing.  For  major  faults,  it  is  proposed  that  both  che  engine  and  the 
aircraft  data  acquisition  units  continually  pass  data  to  a  limited  store  in  the  data  silo.  This  would 
contain  the  last  few  seconds  or  minutes  of  the  flight  prior  to  the  fault  occurring  as  an  Incident  Re¬ 
corder. 

Mechanical  condition  of  the  engine  would  be  monitored  using  separate  tracking  filter  units  to  assess 
each  engine  rotor  out  of  balance.  A  vibration  exceedence  warning  can  be  provided  to  the  pilot,  with 
further  information  available  on  demand  from  the  pilot  or  ground  crew. 

Aerodynamic  deterioration  of  the  engine  may  be  considered  a  "fault"  situation  only  when  it  prevents 
the  aircraft  performing  its  mission.  It  could  be  argued  that  what  is  really  needed  here  is  power  mar¬ 
gin  measurement,  assessing  for  the  particular  aircraft  conditions  how  the  predicted  capabilities  of 
the  specific  engines  compare  with  the  aircraft  power  demands  under  both  normal  and  engine  failure  con¬ 
ditions.  When  a  negative  power  margin  exists  it  would  be  necessary  to  indicate  a  fault,  with  further 
diagnostic  data  being  then  available  through  the  stored  trend  information  or  ’  la  the  Incident  Recorder. 
Power  margin  measurement  is  more  fully  discussed  in  a  later  paragraph,  togc.ner  with  its  use  as  a 
flying  instrument  rather  than  a  fault  indicator. 

4 . 4  In-Flight  Monitoring 

The  replacement  of  the  pilot  function  of  monitoring  such  paramer. rs  as  oil  pressure  and  temperature 
by  a  simple  automatic  routine  within  the  total  health  monitor*  <g  system  should  now  be  seen  as  a  re¬ 
latively  straight-forward  step,  even  if  certification  requirements  still  dictate  an  additional  separate 
low  oil  pressure  warning  system..  Control  monitoring,  lim*  i  exceedence,  limited  engine  failure  and 
engine  usage  monitoring  have  also  all  been  discussed  previously:  with  a  separate  health  monitoring 
CPU  and  suitable  transdv-er  fit  the  system  configuration  should  allow  100%  engine  health  monitoring 
(including  full  control  and  engine  failure  detection),  with  the  capability  of  surviving  a  single  fault 
whilst  retaining  essential  monitoring  services.  Tc  is  therefore  argued  that  the  provision  of  cockpit 
instruments  is  superfluous,  their  function  beir'  undertaken  totally  automatically.  Again,  the  cathode 
ray  tube  form  of  interface  would  allow  a  flex- ole  display  format  with  diagnostic  data  on  engine  con¬ 
ditions  visible  inmediately  following  detection  of  a  fault  or  on  demand  by  the  pilot.  Warning  lights 
as  previously  described  could  provide  independent  fault/limit  data  in  the  event  of  the  cathode  ray 
tube  itself  failing. 

4.5  Enhancement  of  Aircraft  Capabilities 

The  foregoing  description  of  the  general  technical  capabilities  of  a  total  health  monitoring  system 
could  be  summed  up  by  saying  chat,  apart  from  adding  one  or  two  functions,  the  system  can  do  wh3t  is 
currently  done  but  very  much  better  and  with  a  much  reduced  pilot  workload.  Under  some  circumstances 
perhaps  single  pilot  opei  ation  could  become  possible  where  before  two  were  necessary,  but  in  terms  of 
an  enhancement  of  capabilities  this  may  not  be  seen  as  an  overwhelming  advantage.  To  an  extent  it 
would  seem  to  be  the  aircraft  manufacturer's  prerogative  to  use  the  system  capabilities  to  extend  mar¬ 
ket  appeal,  but  the  following  are  given  as  examples  of  what  is  possible. 

4.5.1  Fuel  Management 

Whilst  no*-  strictly  a  health  monitoring  function  more  efficient  aircraft  fuel  management  can  be  obtained 
without  unrealistic  pilot  vorkloaa  by  monitoring  fuel  states,  aircraft  speeds  and  range.  It  is 
assumed  that  a  NAV-AIDS  system  can  provide  distance  to  base  and  vectored  wind  speed  data,  and  that 
Flight  Manual  standard  data  such  as  maximum  and  optimum  sustained  speed  for  a  weight  and  aircraft 
specific  range  are  stored  in  the  program.  From  this  data  and  engine  fuel  flows,  Instantaneous  Speci¬ 
fic  Range  can  be  calculated.  A  final  specific  range  can  be  calculated  based  on  an  all  up  weight  (AUW) 
with  only  reserve  fuel.  The  average  of  these  figures  versus  fuel  content  enables  a  calculation  of 
range:  as  this  figure  approaches  distance  to  base,  the  pilot  can  be  advised  that  he  has  only  X  minutes 
before  a  return  to  base  is  necessary.  This  figure  would  also  be  available  on  demand  at  any  point  in 
the  sortie  together  with  the  optimum  cruise  speed. 

4.5.2  Flight  Instruments 

It  is  claimed  that  there  are  two  really  essential  aircraft  flying  instruments  associated  with  the 
engine,  namely  the  power  turbine/rotor  speed  indicator  and  the  torquemeter  -  altsough  other  engine 
irstruments  are  currently  provided  as  well  (see  para.  3.1).  The  case  for  a  traditional  rotor  speed 
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gauge  is  probably  irrefutable  unless  it  is  accepted  that  the  information  need  only  be  presented  on  a 
"need  to  know"  basis,  i.e.  if  the  rotor  or  free  turbine  departs  from  its  nominal  value  or  range  by 
more  than,  say,  52!.  It  is  doubtful  if  this  "no  news  is  good  news"  arrangement  would  really  find  ready 
acceptance  and  therefore  in  questioning  the  form  of  the  essential  instrumentation  we  will  confine  our¬ 
selves  to  the  torquemeter  only. 

In  a  preceding  paragraph  reference  to  the  use  of  an  aerodynamic  condition  monitor  as  a  fault  diagnostic 
aid  was  made.  In  the  context  of  an  updated  torquemeter  display  the  monitor  pregram  resident  in  the 
health  monitor  CPU  would  contain  a  program  assessing  the  potential  power  currently  available  from  the 
engines  and  a  program  calculating  the  power  required  to  fly  the  aircraft  at  the  AUW  and  outside  air 
temperature  of  the  day.  The  former  program  would  search  for  suitable  steady  state  performance  data 
and  produce  a  matrix  of  power  versus  other  parameters  neeo'd  to  define  the  aerodynamic  state  of  the 
engine.  This  matrix  will  be  continually  compared  with  an  aeroaynamic  model  of  the  engine  to  perform 
data  verifications.  Any  genuine  change  in  the  engine  state  will  show  a  proportional  effect  on  a  num¬ 
ber  of  parameters:  if  only  one  parameter  is  shown  to  be  excessively  outside  this  pattern,  a  fault 
warning  will  be  generated.  Once  validated,  this  performance  matrix  will  be  used  to  update  a  data  file 
periodically,  say  every  2  minutes.  The  data  file  may  be  used  to  compute  the  sum  of  potential  power 
currently  available  from  both  engines  or  from  the  "worst"  one.  These  figures  can  be  directly  compared 
on  a  revised  torquemeter  with  the  power  requirement  for  the  aircraft  calculated  using  Flight  Manual 
data  or  data  derived  from  other  on-board  computation.  The  AUW  figure  would  be  input  into  the  system 
prior  to  take  off  and  updated  during  the  flight  from  data  produced  by  the  fuel  management  program. 

It  should  be  noted  that  a  less  accurate  version  of  this  power  margin  indicator  may  be  feasible  with 
the  basic  control  computer  only,  which  would  be  used  to  predict  the  engine  maximum  power  capability 
approximately.  The  torque  indicator  then  uses  the  combined  actual  output  torques  from  the  engines  to 
provide  an  actual  total  torque  indication  on  one  needle.  Where  an  individual  engine  torque  exceeds 
an  aircraft  limitation  for  the  relevant  number  of  engines  operating,  a  warning  oi  this  may  be  given  in 
the  form  of  an  indicator  light.  The  torque  indicator  also  includes  a  second  needle  which  denotes  the 
predicted  maximum  output  torque  capability  of  one  or  both  engines.  Thus  in  a  high  power  condition 
or  where  the  loss  of  an  engine  could  hazard  the  aircraft,  the  pilot  will  be  able  to  assess  from  a 
single  indicator  not  only  the  total  available  torque  margin  but  also  the  margin  in  an  engine-out 
situation. 


5.  DISCUSSION 


This  paper  has  not  set  out  to  describe  any  fundamentally  new  principles  of  control  or  EHM,  Uhat  has 
been  attempted  is  to  define  those  features  of  control  and  monitoring  which  can  be  seen  to  have  a  close  relat 
ionship,  particularly  where  both  aspects  employ  digital  technology.  By  doing  this,  it  has  been  argued  that 
control  and  EHM  can  logically  be  integrated.  This  in  turn  implies  that  the  total  system  capability  and  cost 
effectiveness  is  improved  if  it  is  recognised  from  the  start  that  such  an  intc  ration  is  possible,  in  that 
the  control  and  EDI  components  of  the  system  can  be  designed  to  be  complementary  to  each  other  with  dupli¬ 
cation  only  where  necessary  for  integrity.  The  approach  allows  the  development  of  a  modular  EHM  system, 
with  basic  functions  available  with  the  digital  control  by  relatively  minor  extensions  to  its  capabilities. 
The  paper  suggests  that  the  advent  of  digital  control  should  transform  the  interface  between  the  pilot  and 
his  power  plants:  Figure  7  summarises  this  new  interface. 


PRIMARY  FLYING  INSTRUMENT 


FIGURE  ^  -  MAN/MACHINE  INTtRFnCE  SbllMAR' 
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Certain  features  of  the  interface  suggested  may  be  considered  as  controversial,  such  as  the  fly-by-wire 
control  arrangement.  The  intention  is  to  show  what  is  possible  if  a  sufficient  determination  exists  to 
exploit  the  capabilities  of  digital  systems.  The  trend  in  sophisticated  military  aircraft  is  certainly 
towards  total  fly-by-wire  with  the  power  plant  seen  as  a  sub-system  addressed  from  a  centralised  digital 
data  highway.  It  is  suggested  that  this  approach  will  eventually  spread  to  helicopters,  to  reduce  the  pilot's 
workload  in  flight  and  to  make  most  efficient  overall  use  of  the  aircraft.  In  any  event,  why  should  the  man/ 
machine  interface  not  be  different?  Perhaps  mechanical  levers  do  have  a  nice  solid  "feel"  to  them,  but  at 
some  point  the  motion  of  netal  rods  must  be  translated  into  the  motion  of  electrons  and  why  not  at  source? 

Although  there  are  references  to  the  difficulties  of  pilots  in  performing  many  monitoring  tasks,  it  is  re¬ 
cognised  that  helicopters  have  been  flying  very  successfully  for  many  years  and  therefore  they  undeniably 
have  acquired  adequate  proficiency  at  it.  However,  piloting  a  helicopter  is  only  a  means  to  an  end  and  there 
is  little  virtue  in  making  the  job  more  difficult  than  it  need  be.  This  is  really  why  it  is  suggested  that 
the  total  man/machine  interface  should  be  reconfigured,  to  allow  a  better  monitoring  job  to  be  carried  out 
automatically.  Digital  technology  allows  this  to  be  done,  and  the  resulting  system  capability  is  vastly 
superior  in  total  aircraft  health  monitoring  to  the  present  "eyeball"  arrangement. 

Inherent  in  much  of  the  foregoing  is  an  acceptance  by  certification  authorities  of  the  approach  taken.  This 
paper  is  by  no  means  a  detailed  system  definition  and  much  design  work  would  need  to  be  done  to  configure  the 
system  such  that  all  operational  and  failure  criteria  are  satisfied.  It  is  believed  that  it  could  be  easier 
to  satisfy  civil  agencies  on  the  system  design  than  some  military  procurement  authorities  which  specify  how 
a  job  shali  oe  done  rather  than  what  end  result  is  required. 

The  technology  to  achieve  the  integrated  system  proposed  basically  exists.  Rolls-Royce  are  currently  in¬ 
volved  in  the  design  and  development  of  digital  controls  for  helicopter  engines  which  could  form  part  of 
such  a  system.  Parallel  EHM  programmes  are  also  in  progress  within  Rolls-Royce  aimed  at  full  understanding 
of  the  technology,  developing  the  software  necessary  to  derive  meaningful  EHM  data  from  helicopter  engines 
in  flight  and  also  developing  some  of  the  necessary  hardware.  Significant  experience  has  been  gained  in 
on-board  digital  data  acquisition  and  with  subsequent  processing  of  data  to  produce  engine  usage  and  condi¬ 
tion  read-out. 

The  question  arises  as  to  whether  any  but  the  most  complex  helicopters  could  be  fitted  with  such  an  integra¬ 
ted  system  from  the  cost  viewpoint  alone.  The  answei  probably  depends  on  the  aircraft  manufacturer's  atti¬ 
tudes  towards  first  cost  and  life  cycle  cost  issues.  Certainly  the  first  cost  is  significantly  higher  and 
if  this  is  seen  as  the  overriding  consideration  then  the  answer  is  self  evident  although  there  would  be 
some  associated  reduction  in  the  aircraft  costs  due  to  installation  and  instrumentation  savings.  If,  how¬ 
ever,  the  cost  of  ownership  is  seen  as  more  important  then  such  a  system  must  have  major  advantages.  It  is, 
however,  difficult  to  quantify  these  until  .he  detail  design  of  the  system  has  been  completed  and  costed  and 
the  benefits  defined  in  terms  of  maintenance  reduction  and  aircraft  utilisation  improvements.  Some  of  the 
benefits  are  less  tangible,  for  example  a  lower  pilot  workload  which  could  lead  to  improved  flight  safety 
is  not  likely  to  have  any  attributed  cost  savings. 

Another  major  difficulty  in  achieving  further  progress  towards  a  system  having  the  capabilities  described  in 
this  paper  is  that  it  requires  a  number  of  different  design  and  procurement  areas  of  the  aircraft  to  be 
embraced.  Agreement  must  be  reached  between  all  interested  parties  as  to  overall  requirements  and  system 
configuration:  it  is  hoped  that  this  paper  will  provide  the  basis  for  further  discussions  within  both  the 
engine  and  the  aircraft  industries. 


REFERENCE  1  "Helicopter  Engine  Control  -  The  past  20  years  and  the  next"  by  E.A.  Simonis  and 
M  P  Perks 

(Paper  presented  at  44th  AGARD  Propulsion  and  Energetics  Panel  meeting  or.  Power 
Plant  Controls  for  Aero  Gas  Turbines  held  at  Ustaoset,  Norway  in  September  1974) 
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DISCUSSION 


R.Smyth,  Ge 

Pilot  workload.  This  is  a  comment  to  the  speaker’s  remarks  on  reduction  in  workload  in  the  cockpit. 

The  application  of  microprocessors  for  improving  engine  control  must  also  include  the  external  control  loop  of  the 
installed  engines  (i.e.  the  control  loop  with  the  pilot  monitoring  engine  condition).  Present  workload  of  the  pilot  is 
quite  high.  This  can  be  seen  by  the  evidence  of  the  engine  operating  hand  books,  which  are  getting  thicker  instead 
of  becoming  thinner.  Here  is  an  area  where  efficient  use  of  the  microprocessor  must  be  seen  in  the  subject  of  engine 
control. 

Author’s  Reply 

This  is  one  of  the  important  points  of  the  paper.  We  have  heard  a  lot  about  how  digital  control  offers  the  control 
engineer  the  capability  of  advanced  control  laws  etc.  We  must  not  forget  however  that  there  is  a  man  somewhere  in 
the  aircraft  and  we  ought  to  address  ourselves  to  the  task  of  making  life  easier  for  him.  Digital  technology  allows 
this  to  be  done  and  the  paper  suggests  a  way  of  taking  advantage  of  the  technology  from  the  pilot’s  and  operator’s 
viewpoints  as  well. 


R.D.Matulka,  US 

What  is  the  state  of  development  of  an  integrated  system  such  as  the  one  you  describe 

Author’s  Reply 

The  control  features  of  the  system  have  essentially  been  demonstrated,  including  the  push  button  engine  control 
aspects.  Both  the  software  and  hardware  aspects  of  many  of  the  health  monitoring  features  are  under  development 
in  a  flying  test  bed,  with  off-line  monitoring  via  data  acquisition  units  an  already  developed  concept. 

The  totally  integrated  arrangement  described  is  however  at  this  time  conceptual  only. 


_ _  _ _ 

RTD-1 

ROUND  TABLE  DISCUSSION 

E.E.Covert:  What  we  propose  to  do  in  the  remaining  time  until  4  o’clock,  I  have  asked  members  of  the  Panel 


Dr  Dunham  NOTE  UK 

W.Kaemmer  VDO  Germany 

J.  Collin  SNECMA  France 

Dr  Bentz  Air  Force  USA 


to  give  us  about  a  5  minutes  presentation  to  define  what  they  believe  the  principle  issues  are  in  the  area  of  modern  control 
technology,  and  whether  the  evolution  is  in  the  correct  direction.  Finally,  since  all  of  us  have  heard  so  much  about 
modern  control  technology  for  the  past  10  years  and  we  who  are  here  believe  firmly  in  it,  1  asked  them  why  in  their 
opinion  modern  control  systems  are  not  being  installed  on  aircraft,  helicopters  and  so  forth. 

Without  further  delay  let  us  go  from  my  left  to  the  right  and,.  1  will  be  rude  John,  but  at  the  end  of  5  minutes  I  will 
interrupt  you  because  time  is  at  a  premium. 

J. Dunham:  I  don’t  represent  any  other  than  my  own  view  here,  I  am  not  in  any  way  representing  the  UK  consensus  view 
on  what  we  should  be  doing  about  aero  engine  controls.  For  one  thing,  there  are  lots  of  other  people  from  the  UK  here 
who  can  well  represent  themselves;  and  for  another  thing  there  is  no  such  thing  as  a  consensus  of  views  between  a  group 
of  control  system  people  as  to  what  we  should  be  doing  and  how  we  should  be  doing  it,  I  think  that  is  one  good  reason 
for  having  a  PEP  meeting  on  the  subject.  If  thei~  were  nothing  to  disagree  about,  there  would  be  nothing  to  talk  about 
perhaps.  So  I  will  concentrate  on  the  disagreements,  because  obviously  there  are  many  aspects  of  control  system  develop¬ 
ment  that  we  all  agree  on.  But  there  are  a  number  of  significant  problems  that  haven’t  yet  been  sorted  out  by  experience 
into  an  agreed  answer. 

One  of  the  things  that  is  still  a  matter  of  debate  is  the  level  and  type  of  redundancy  which  is  necessary  for  any  of  the 
systems,  that  we  have  been  talking  about,  because  there  is  a  conflict  with  reliability  1  think  this  is  best  expressed  by  the 
no-doubt-apocrypha!  tale  of  the  famous  French  aviator  Bleriot  when  he  was  about  to  cross  the  Channel  for  the  first  time 
in  his  aircraft  in  1909.  Somebody  said  “You  have  only  a  single-engined  aircraft.  Why  don’t  you  have  two  engines:  it 
would  be  a  bit  safer?”  And  he  said.  “Two  of  the  wretched  things?  I  have  enough  trouble  keeping  one  of  them  going!” 
Well,  that  is  really,  m  a  nutshell,  the  problem  that  we  face  in  deciding  redundancy  levels.  There  are  supervisory  systems, 
there  are  manual  reversion  systems,  there  are  single  lane  systems,  there  are  electronic  reversion  systems.  This  is  one  of 
the  problems  that  remains  a  subject  of  controversy  between  different  people. 

The  second  question  that  remains  to  be  resolved  is  the  matter  of  central  or  distributed  control  functions.  There  are 
people  who  say  that  if  you  have  a  modular  system  then  it  can  be  safer  and  it  can  be  demonstrated  to  be  safer  to  our 
certificating  authorities.  To  some  extent  that  is  not  just  modular  programming  but  hardware  modules  as  well,  and  this 
militates  against  any  sort  of  central  system.  But  we  have  alw.  seen  some  papers  this  week  suggesting  that  there  should  be 
grand  central  systems  controlling  a  large  number  of  functions.  This  again  remains  to  be  resolved,  1  think  by  experience. 

A  third  question  is  related  and  amounts  to  the  question  that  I  asked  this  morning  about  the  division  of  functions 
oetween  the  autopilot  and  the  engine  controller.  Which  part  of  the  system  is  responsible  for  what,  in  an  aircraft  which 
has  a  large  number  of  flight  control  systems  and  other  electronic  devices  on  board? 

The  fourth  question  which  struck  me  as  one  which  still  remains  to  be  resolved  is  the  question  as  where  to  put  the 
controller  box,  engine  mounting  or  anframe  mounting.  It  is  clear  that  any  one  box  is  going  to  last  longer  and  be  lot 
cheaper  if  it  is  mounted  in  the  airframe. 

On  the  other  hand,  if  there  are  a  lot  of  sensors  or  any  other  connections  to  the  engine,  then  studies  have 
demonstrated  that  it  is  better  to  mount  the  electronics  on  the  engine  and  accept  the  extra  weight  and  cost  involved  in 
making  it  withstand  the  environment. 

Another  problem  that  remains  to  be  resolved  is  the  use  of  high  level  languages  or  otherwise.  Here  again  it  is  a 
problem  of  visibility  aid  a  problem  perhaps  of  compilers.  At  the  moment  there  is  no  great  problem,  because  there  are 
no  adequately  proven  compilers  for  the  microprocessors  we  use.  But  there  will  be  in  the  coming  years  a  problem  in  the 
use  of  high  level  languages  oi  otherwise  in  engine  control. 

There  are  some  future  problems  that  we  must  also  consider.  One  of  them  is  the  question  of  multiple  variables, 
because  there  is  a  tendency  to  have  engines  with  more  variables  The  question  has  already  been  asked,  and  not  received  a 
satisfactory  answer,  as  to  whether  the  use  of  modern  multi-variable  control  theory  will  or  will  not  give  us  a  real  advantage 

Personally,  my  feelings  about  the  meeting  was  that  w»>  are  still  in  that  state  of  technology  where  we  inevitably  had  a 
gieat  number  of  qualitative  papers,  and  not  as  many  quantitative  results  as  perhaps  I  would  have  hoped.  Thank  you 

W.Kaemtner  1  have  a  problem.  1  can  t  be  as  good  as  you  were  and  you  have  already  been  talking  about  many  of  the 
subjects  I  found  duiing  the  session  and  so  let  me  summarize  and  possibly  even  shorten.  I  think  that  whilst  we  heard  quite 
a  variety  of  brochures  to  my  understanding,  and  I  have  to  emphasise  it’s  my  own  personal  understanding,  with  all  the 
possibilities  given  by  the  modern  electronics  we  still  have  to  solve  the  problem  ol  the  sensor  side  of  it  And  1  think  it’s 
a  challenge  of  the  next  years,  we  will  certainly  overcome  the  problems  described  m  the  papers  but  we  certainly  will  have 
to  work  hard  to  overcome  the  problems  of  the  sensors  And  to  my  understanding  it’s  'be  vital  question.  The  second  one. 
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you  already  have  mentioned  it,  it  is  certainly  to  be  decided,  if  we  go  to  modular  systems  or  modular  in  the  sense  of 
divided  authorities  or  if  we  go  to  central  systems.  And  one  of  my  colleagues  of  VFW  earlier  has  possibly  asked  the  most 
vital  question.  In  my  understanding  it  is  the  question  of  the  man-machine  relationship  We  have  been  looking  into  a 
cockpit  of  a  convetional  helicopter  and  we  all  know  what  is  the  task  of  the  p.lot  during  rather  hard  manoeuvres  and  1 
think  the  only  profit  we  can  give  to  those  hard  working  guys,  is  to  give  them  the  tools  which  are  already  available  as  far 
as  those  papers  are  concerned  we  have  been  looking  at,  that  they  can  achieve  their  tasks  easier  and  by  easing  their  tasks 
make  flying  even  safer  than  it  is  today.  I  think  this  is  the  summarizing  I  can  do  from  this  and  the  wishes  I  have  in  the 
direction  of  this  panel. 

C.E.Bentz:  by  way  of  introduction..  1  come  from  the  Air  Force  Aero  Propulsion  Laboratory.  It  is  not  immediately 
obvious  to  everyone  that  wt  in  the  propulsion  community  are  in  a  change  fiom  basic  hydromechanical  to  sophisticated 
electronic  computation  for  our  engine  fuel  controllers.  This  is  a  rather  rapid  change  when  you  consider  that  1 0  years  ago 
we  depended  almost  entirely  on  hydromechanical  computation  in  all  our  fuel  control  systems  Today  we  have  talked 
about  having  electronic  controls  on  turbine  engines  when,  in  fact,  many  electronic  controls  are  currently  in  operational 
service  on  an  Air  Force  high-performance  engine  and  we  are  now  just  beginning  to  learn  important  information  from  its 
usage  and  performance  in  the  field.  The  most  significant  factor  that  influenced  the  selection  of  an  electronic  control  for 
the  engine  was  the  envelope  in  which  the  airplane  was  to  fly.  And  I  can’t  help  but  detect  from  the  discussions  today  that 
we,  as  a  control  community  and  possibly  the  engine  community,  are  frustrated  if  not  discouraged  because  of  the  limited 
opportunities  for  application  of  electronic  controllers  in  current  and  future  military  and  commercial  systems  I  must  say 
that  it  takes  approximately  1 5  years  of  research,  engineering  and  acquisition  development  before  an  engine  enters 
operational  service  so  have  patience.  On  the  other  hand,  the  airframe  from  initial  design  to  first  flight  may  take  five 
years.  So  we  must  dedicate  ourselves  to  continue  our  research  and  development  activity  to  acquire  sufficient  background 
data  to  meet  the  reliability  and  cost  goals  of  future  engine  applications.  And  along  these  lines,  we  must  look  for  methodo¬ 
logies  in  which  we  can  ensure  the  design,  development  and  qualification  of  the  most  highly  reliable  system  in  terms  of 
the  engine-mounted  hardware  or  off-engme  mounted  hardware  that  can  be  attained  for  that  particular  time  period  in 
technology.  Let  me  explain  what  is  meant  by  this  statement  If  we  are  influenced  by  the  design  requirements  of  the  air¬ 
frame  industry,-  then  two  or  three  computers  would  be  assigned  to  control  each  engine  to  achieve  overall  system  reliability 
goals.  From  a  hardware  viewpoint,  this  may  not  appear  to  be  cost  effective  in  that  the  cost  of  the  engine  control  system 
increases  two-  or  three-fold.  In  addition,  a  software  management  problem  may  result  during  the  service  life  of  the  engine 
if  the  engine  manufacturer  does  not  maintain  total  responsibility  for  the  on-engine  or  off-engine  mounted  electronic 
control  hardware,  especially  in  the  area  of  fault  accommodation  modes  for  full-authority  electronic  controllers  So  in  the 
next  few  years,  I  see  a  great  need  in  obtaining  research  and  development  experience  on  engines  to  design  and  develop 
control  systems  that  will  accommodate  faults  within  the  software  as  well  as  within  the  hardware  to  meet  the  future  need 
of  having  control  system  reliability  which  is  as  good  us  or  better  than  the  hydromechanical  control  systems  which  the 
electronic  systems  will  replace. 

One  of  the  mam  advantages  of  the  all-digital  electronic  control  system  is  the  ability  to  integrate  engine  components 
to  higher  levels  of  performance  through  more  precise  control.  Hence,  better  fuel  economy  and  better  stability  margin 
can  be  achieved  both  in  supersonic  us  well  as  in  subsonic  flight.  Several  years  ago,  we  conducted  some  research  flight 
tests  on  a  high-performance  aircraft  and  found  tlut  a  closed  loop  electronic  fuel  control  could  improve  aircraft  range  by 
lo  percent  during  augmented  operation.  Using  the  electronic  control  to  implement  the  bill-of-matenal  control  design,  we 
could  increase  the  altitude  at  which  the  engine  could  relight  the  augmentor  by  as  much  as  5.000  ft  Another  important 
feature  is  that  we  could  operate  and  relight  the  engine  at  lower  Mach  number,  higher  altitude  conditions  because  the 
electronic  system  would  automatically  take  over  and  iestart  the  engine  on  spool  down  So  there  are  many  advantages 
that  can  be  achieved  with  a  digital  control  so  we  must  have  patience  and  perseverance  during  these  trying  times  of  limited 
research  budgets  and  fewer  engine  programs  when  there  is  not  enough  money  to  support  or  sustain  the  important  work 
that  must  be  accomplished. 

J .Collin .  La  plupart  des  points  importants  on  ete  trades  par  mes  collegues.  je  voudrais  quand  meme  ajouter  que  quels 
que  soient  les  progres  de  la  technologic.  I’electronique  tomberu  toujours  en  panne,  qu'il  i  onviendra  de  definir  methodique- 
ment  et  systematiquement  des  architectures  qui  tiendront  compte  de  ce  faeteur  ct  dans  ces  conditions  la.  en  aeceptant 
les  contramtes  resultant  de  ['existence  meme  de  ces  pannes,  on  pourra  obtemr  au  niveau  de  systemes  piopulsifs  des 
niveaux  de  performance,  des  niveaux  de  succes  de  mission,  des  niveaux  de  secunte  de  mission  extremement  eieves  La 
plupart  des  points  on  ete  trades,  je  vais  vous  poser  des  questions.  J'aurais  aime  voir  aborde  pendant  ces  sessions  le 
probleme  de  la  documentation  des  logdiclles.  comment  eerne  line  documentation  logitielle  accessible  a  l’utilisateur  Je 
ne  repondrai  pas  a  ces  question,  je  les  pose  Un  deuxieme  element  concerne  la  standardization  des  logitielles.  lorsqu'un 
utilisateur  doit  disposer  d’un  avion  avec  10  types  de  micro-processeurs.  on  1 5  types  de  nucro-processeurs  ay  ant  chacun 
leur  logitielle.  leur  eompilaleur.  etc  .  comment  va-t-il  se  sortir  de  ce  probleme'’  N’y  a  t-il  pas  lieu  dVnus.,gci  line 
normalisation  taut  au  niveau  des  logitielles  que  des  materiels  J'ai  note  egalement  qu’un  des  orateurs  a  parle  de  circuits  a 
tres  hunt  niveau  d'integration  de  circuits  VLSI.  Lst-ce  qu'on  commit  exacteinent  leur  coinportunent  dans  l’environne- 
menl  physique  du  moteur  l.st  ce  qu’on  a  bien  conscience  par  example  que  les  meinoires  sont  sensibles  aux  radiations 
residuelles  de  leur  bolder  d ’encapsulation  Lst  qu’on  sail  tester  les  circuits  VLSI  Lst  ce  qu’on  sad  tester  les 
compilateurs  de  haut  niveau  Lncore  deux  questions  qui  sont  encore  plus  tnviales  est  ce  que  les  families  de  composants 
sont  effectivemeni  toutes  dispombbs  dans  la  pleine  gamine  lnilitaire.  au  moms  en  55  plus  1  25  degres  et  avec  des  critere  . 
de  deverminage  et  dans  des  niveaux  a  haute  tiabilite.  alors  qu’il  seinble  que  les  fabric  mts  de  semi-conducteurs  s’interessent 
plutot  au  marche  de  la  machine  a  laver  et  de  l'antomobilc  qu’au  niarche  de  Fav loniquc  qui  represente  line  taiblc  part  de 
leur  production  Ln  ce  jut  concerne  les  couts.  ellcctiveiiicnt,  si  on  compare  le  cout  potential  d’un  regulateur  electronique 
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au  cout  d’une  calculatrice  de  poche,  on  risque  d’avoir  queiques  dcsappomtements  et  en  particulier  aujourd’hui  i)  y  a  un 
faetcur  de  cout  extremement  important,  c’est  le  cout  des  interfaces  analogiques  d’entree  et  des  interfaces  de  sorties  qui 
prurront  peut-etre  -  bien  que  la  nature  soit  analogique  -  etre  resolu  par  la  mise  en  place  de  capteurs  et  d’actuateurs 
■daptes.  J’en  ai  termine  avec  mes  questions,  j’espere  que  lors  d’un  prochain  congres  AGARD,  j’aurai  une  rdponse  a  toutes 
ces  questions.  Merci. 

E.E.Covert:  Thank  you.  I  hope  you  all  will  not  be  too  disappointed  if  you  don’t  get  all  those  answers.  I  think  I  would 
like  to  make  one  or  two  comments  I  will  restrict  myself  if  I  may  to  some  of  the  experience  with  the  space  shuttle  which 
was  not  illustrated  in  the  presentation  yesterday  morning.  1  think  that  there  are  features  and  consquences  of  that  auto¬ 
matic  control  system  that  are  not  widely  appreciated.  One  of  which  is  that  to  develop  a  50  000  seconds  life  on  a  large 
rocket  with  only  1 5  development  engines  is  something  which  is  unheard  of.  The  experience  with  tl  e  development  of 
the  Apollo-Programme  at  the  same  point  would  require  somewhere,  if  my  memory  is  correct,  in  the  neighbourhood  of 
about  45  or  50  builds.  Money  has  been  saved  simply  by  having  a  controller  that  is  so  quick  that  it  can  detect  a  difficulty 
and  shut  down  the  engine  before  the  failure  takes  place.  This  alone  is  very  impressive  Now  it  is  even  more  impressive 
when  you  recognise  that  that  engine  is  burning  a  thousand  pounds  a  second  of  hydrogen  and  oxygen  so  there  is  no 
such  a  thing  as  a  minor  fire.  Under  those  circumstances  even  a  trivial  mistake  is  spectacular.  A  second  thing  that  the 
system  has  been  able  to  do  is  to  be  reprogrammed  to  shape  the  motion  of  the  valves  during  starting  and  stopping.  NASA 
and  its  contractors  have  effectively  eliminated  all  of  the  hot  spikes  by  making  sure  that  the  system  is  oxygen  lean  at  start 
and  shut  down.  This  change  also  increases  the  life  of  the  engine  and  increases  the  reliability.  It  also  illustrates  the 
flexibility  that  a  digital  system  gives  you.  You  don’t  have  to  bend  any  tin  in  order  to  make  a  change,  you  just 
reprogramme  a  card. 

I  could  go  on  at  gieat  length  but  this  would  get  boring  after  a  while,  so  I  stop  here  and  throw  the  discussion  open 
to  the  floor.  Anyone  of  the  people  on  the  platform  is  fair  game,  I  would  appreciate  it  if  you  would  address  your 
question  to  one  of  them  and  not  afford  me  the  opportunity  to  try  to  decide  who  you  want  to  answer  your  question.  So 
go  ahead  please. 

D. M  .Griffiths:  None  of  the  panel  mentioned  the  lack  of  firm  projects  as  a  contributing  factor  in  the  failure  of  digital 
controls  yet  to  achieve  production  status.  This  may  be  more  true  in  Europe  rather  than  in  North  America. 

Would  the  panel  agree  and  would  a  panel  member  from  Europe  care  to  comment?  (Which  excuses  the  Chairman! ) 

J. Dunham:  Yes,  I  think  many  of  us  have  been  saying  we  will  have  a  digital  control  on  our  next  engine  When  is  our 
next  engine?  Of  course,  you  are  perfectly  right  in  saying  that  we  haven’t  got  digital  control  committed  to  an  engine 
because  the  last  engine  we  committed  was  now  some  years  ago. 

E. E.Covert.  There  is  a  lot  of  talk  about  a  1990’s  fighter,  if  Dr  Bentz’s  discussion  of  15  years  to  an  engine  bears  any  truth 
at  all  it  seems  to  me  that  they  better  get  on  the  stick,  if  I  might  use  that  expression.  Do  you  think  that  is  going  to 
happen?  A  I990’s  fighter  is  going  to  be  laid  down? 

J. Dunham:  Yes. 

E.E.Covert:  Is  there  evidence  that  the  engine  is  about  to  be  started  to  that? 

J.D unham '  I  don’t  know  whether  it  will  be  a  new  engine.  Obviously  one  does  not  know  at  this  stage  whether  these 
fighters  either  in  ihe  US  or  in  Europe  will  have  existing  engines  cr  new  engines.  But  what  we  are  living  in  hope  and 
indeed  conviction  about  is  that,  whether  it  is  an  old  one  or  a  new  one,  it  will  have  a  digital  control  box  on  it. 

l.S.D  Stitt:  Keyword  Projects.  Mr  Bentz  outlined  the  advantages  that  can  be  achieved  with  electronic  controls.  Would 
he  care  to  comment  on  whether  these  advantages  would  be  achieved  by  retrofitting  the  controls  on  existing  engines  and 
whether  this  would  be  cost  effective 

C.E. Bentz:  Yes,  there  would  be  advantages  in  engine  performance  and  in  operational  and  support  costs  in  retrofitting 
controls  on  existing  engines,  ho  we,'  ,  the  cost  is  strictly  prohibitive  to  go  back  and  requalify  an  electronic  control  for 
an  in-service  engine,  plus  the  cost  an  .  logistics  of  reconfiguring  every  engine  control  in  a  timely  manner.  It  is  barely 
enough  money  to  build  a  new  engine  with  an  electronic  control  Of  course,  you  can  estimate  the  advantages  of  an 
electronic  control  systtm,  but  it  is  hard  to  prove  it  to  anybody  with  service  experience.  There  are  certainly  advantages 
in  fuel  savings  and  improved  thrust  performance  with  an  electronic  control  system,  but  the  cost  would  be  prohibitive  to 
go  back  and  retrofit  every  engine  with  an  electronic  box. 

G.E. Davies  We  have  heard  many  interesting  papers  in  the  last  two  days  showing  the  great  power  and  versatility  of  digital 
control  systems  Most  of  these  covered  work  on  existing  engines  where  the  original  control  system  was  replaced  by  a 
digital  system  We  have  also  heard  in  one  or  two  papers  a  suggestion  that  engines  might  be  made  more  efficient  by 
reducing  the  number  of  compressoi  stages,  for  example,  and  using  digital  techniques  to  run  much  closer  to  surge  than  is 
possible  at  present  My  question  is  a  general  one  and  is  this  Will  we  have  the  courage  in  the  next  engines  to  be  designed 
to  make  them  irrevocably  dependent  on  the  full  capability  of  digital  control  systems  by  designing  them  to  work  much 
closer  to  all  the  performance  and  stability  limits' 
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C.E.Bentz:  Every  new  engine  that  we  are  looking  at  have  components  that  are  more  highly  loaded  than  before  and  are 
considering  full-authority,  digital  controllers  to  better  regulate  the  engine  throughout  >'ts  operational  envelope. 

Because  we  are  designing  for  greater  performance  and  maintainability  in  future  engines,  we  are  also  including  diagnostic 
functions  in  the  control  to  detect  control  malfunctions  and  monitor  engine  component  degradations. 

E.E.Covert:  One  quick  question.  You  talk  about  electronic  controls,  are  you  talking  about  a  system  in  which  the  loop  is 
always  closed? 

C. E.Bentz:  Yes. 

E.E.Covert:  It  was  not  clear  to  me  in  some  of  the  discussions  that  we  have  had  in  the  last  few  days,  whether  an  electronic 
system  was  an  open  loop  or  closed  loop  system,  and  1  believe  the  advantages  of  a  closed  loop  are  so  great  that  it  would  not 
be  wise  to  think  much  longer  about  open  loop  systems. 

J. Dunham:  I  was  going  to  say  something  quite  similar.  We  cannot  utilize  a  reduced  surge  margin  at  the  moment  in 
controls  based  on  fuel  scheduling,  because  of  engine  deterioration  and  engine  inlet  distortion  problems  and  so  on.  The 
only  way  we  could  really  guarantee  being  able  to  run  with  a  much  reduced  surge  margin  and  design  for  that  initially 
would  be  to  have  a  closed  loop.  To  have  a  closed  loop  you  have  to  detect  the  incipient  surge  in  some  way.  At  the  last 
AGAR1)  controls  meeting  1  presented  a  paper  showing  how  you  could  have  a  closed  loop  control  which  will  stop  reheat 
buzz;  but  you  can’t  do  this  with  surge.  With  some  engines  it  has  been  demonstrated  long  ago,  but  we  can’t  guarantee  to 
detect  incipient  surge  on  every  engine  in  time  to  take  action  to  avert  it,  and  hence  generate  a  closed  loop.  That  is  not  a 
digital  control  problem,  it’s  a  problem  of  compressor  technology. 

J.F  Evans:  The  reliability  of  high  level  compilers  has  been  questioned.  Does  the  panel  think  that  is  not  similar  to 
doubting  the  quality  of  a  component  produced  in  an  automatic  milling  machine?  Evidently  in  either  case  the  resulting 
product  is  harder  to  test.  In  both  cases  mistakes  once  made  can  be  ‘designed  out’  for  future  components. 

J.Collin:  11  tie  s’agissait  pas  d’opposer  des  pannes  de  composants  mecamques  sur  lesquelles  j’ai  assez  peu  de  donneeaux 
pannes  de  composants  numenques,  mais  je  crois  que  1’introduction  des  circuits  numeriques  nous  oblige  a  prendre  en 
compte  des  pannes  transiloires  ou  des  pattern  sensitives  qui  n’existent  pas  jusqu'a  present  dans  les  systemes  analogiques 
que  nous  utilisons. 

D. J. Hawes:  As  environment  has  such  an  influence  on  reliability  would  it  not  be  advantageous  to  the  environment  to  be 
specified  by  the  engine  manufacturer  to  the  control  vendor  based  on  expected  values  in  a  specially  designed  mounting 
rather  than  the  "ad  hoc”  manipulation  of  MIL-Specs,  and  the  alternative  of  airframe  mounting  with  the  associated 
management  problems.  1  believe  that  in  future  instead  of  just  taking  MIL-Spec,  and  guessingat  some  profile,  would  it  not 
be  better  if  the  engine  manufacturer  was  to  take  the  responsibility  of  providing  the  environment  for  the  control  system 
just  as  it  is  now  on  the  gearbox  for  example  for  highly  mechanical  control? 

E. E.Covert:  If  I  may  say  so,  that  is  a  very  valid  suggestion  1  know  of  at  least  one  application  in  the  United  States,  where 
the  situation  was  finally  resolved  by  measuring  the  acceleration  and  the  temperature  and  acoustic  level  at  the  equipment 
location  and  designing  the  equipment  to  live  in  that  environment.  Of  course,  one  must  design  a  sort  of  test  to  ensure  that 
the  environment  could  be  duplicated  in  a  laboratory  and  the  equipment  ’would  satisfy  those  requirements  In  this  case  it 
was  of  utmost  importance  to  be  able  to  duplicate  the  engine  environment  in  the  laboratory  Before  the  latter  step  was 
taken  the  equipment  was  not  very  satisfactory  because  even  though  it  pa  s’  u  all  the  other  SPEC’s  i:  would  not  live  happily 
with  the  engine. 

R.Lo: 

(1)  Should  tli'  implementation  of  CCU  technology  be  integrated  with  proper  engine  controllers?  Will  engine 
control  bring  an  additional  dependency  upon  well  working  computers? 

(2)  Is  the  community  aware  of  the  effort  at  the  University  of  Califorma  to  base  engine  health  monitoring  on 
acoustical  analysis  of  the  engine  noise?  (It  has  been  demonstrated  tint  this  is  feasible  and  it  suiely  requires  a 
lot  of  data  processing.) 

C.E.Bentz:  In  cases  that  1  have  observed,  the  controller  is  much  faster  in  response  than  any  of  tiie  dynamics  of  the 
rotating  engine  components  The  actuators,  in  some  cases  are  limiting,  especially  those  that  move  large  loads.  The 
control  strategies  and  the  speed  of  the  computer  need  to  be  looked  at  very  carefully  If  you  implement  a  control  design 
on  the  basis  ot  a  single-input,  single-output  system  using  classical  techniques,  and  you  handle  all  the  cross  couplings  of 
a  multi-loop  engine  (3  loops.  4  loops.  5  loops  and  so  on)  you  soon  run  out  of  cycle  time  in  the  computer.  In  my 
opmon,  classical  techniques  can  no  longer  be  used  to  design  controllers  for  future  complex  engines  where  tliei 1  is  a  lngh 
degree  of  cross  coupling  and  maintain  adequate  stability  margin  for  the  engine  across  the  V  ght  envelope.  The  efore. 
more  advanced  design  techniques  such  as  multi-variable  strategies  must  be  considered  for  engine  control  problems 
where  there  are  a  large  number  <  f  interactions 
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These  Conference  Proceedings  contain  the  1 9  papers  presented  at  the  AGARD  Propulsion  and 
Energetics  Panel  54th(A)  Specialists’  Meeting  on  ‘Advanced  Control  Systems  for  Aircraft 
Powerplants’  which  was  held  in  Cologne,  Germany,  on  1-2  October  1979.  The  questions 
and  answers  after  the  presentation  of  each  paper  as  well  as  the  Round  Table  Discussion  at 
the  end  of  the  meeting  are  included. 

The  Meeting  was  in  five  sessions:  Development  Experience,  Control  Implementation, 
Optimum  Control  Strategies,  Digital  Control  Concepts,  and  the  Round  Table  Discussion 

The  meeting  was  focussed  on  current  and  projected  developments  in  control  systems  for 
aircraft  powerplants.  The  application  o'’  digital  control  technology  on  aircraft  turbine 
engines  was  especially  emphasized.  The  meeting  served  as  a  platform  for  discussion  and 
exchange  between  research  scientists,  development  specialists  and  applicants  of  control 
systems. 

Whether  the  meeting  achieved  its  initial  aim  of  furnishing  a  comprehensive  control  system 
technology  survey  will  be  assessed  in  a  Technical  Evaluation  Report  to  be  published  as 
AGARD  Advisory  Report  AR  152. 
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